Protected: Protocol Buffers for Forensic Examiners: The Varint Trap
March 25, 2026
No Comments
There is no excerpt because this is a protected post.
SQLite Visualizer is here
Work dramatically faster and recover more evidence than ever before
Fast access to top-tier training and expert tools for digital forensics
Accelerate and sharpen your digital forensic work
Expert Tools
Enhance your toolkit with clearer, more precise forensic analysis. Designed to complement your trusted platforms, our solutions help you work sharper and with greater precision.
Training Programs
Learn how to master comprehensive digital forensics workflows through immersive, hands-on training. Confidently apply your skills in real investigations.
Micro-Learning
Targeted micro-learning modules to help you rapidly address critical challenges, strengthen expertise, and stay fully up to date.
digital forensics tools
Forensic tools that help you see more, find more, and work faster
varint decoding made easy
VarInt Calculator.
An app for calculating and decoding VarInts.
Instantly decode variable-length integers from SQLite databases, protobuf messages, and app data structures. This utility converts hex values to decimal in seconds, perfect for analyzing WhatsApp databases, custom app formats, and messaging data without requiring custom scripts.
advanced database analysis
A brand new way to explore SQLite
ED SQLite Visualizer transforms how you analyze mobile databases. Trace deleted records frame by frame. Map complex schema relationships visually. Recover evidence from WAL files and unallocated space through an intuitive interface designed for modern investigations.
From backup chaos to file system
Backup 2FS. A free tool to recover and normalize files from iOS backups.
Transform iOS backup data into organized, navigable file structures. This free Windows tool extracts and normalizes iTunes backup content, complete with hash verification and device metadata. Access your backup data through a clear, logical file system ready for efficient analysis and reporting.
digital forensics micro-learning
Targeted micro-learning modules to help you rapidly address critical challenges
Understanding WAL Frames and SHM Index
Dive into SQLite's most overlooked files
Learn to extract deleted or uncommitted data from WAL and SHM, reconstruct timelines, and uncover hidden app activity your tools can’t show.
SQLITE data structures
Get immediate, practical skills to uncover the app evidence your tools miss
Learn to manually decode pages, recover deleted records, and confidently validate your findings, perfect when you need precise, court-ready evidence.
full digital forensics training programs
Master forensic fundamentals and uncover evidence your tools overlook
Build deeper expertise with immersive, certified training programs
Foundational Level
Start strong with the essentials. Learn how to collect, examine, and explain digital evidence. From data acquisition to reporting, build practical skills through real cases and guided labs. Built for those starting out or refreshing the basics.
foundational level
Become an expert in mobile forensics, from acquisition to reporting. Built for real cases, updated for today’s Android and iOS challenges. Gain skills that go beyond tool output.
advanced level
Explore SQLite databases in depth, the hidden layer beneath mobile apps and operating systems. Learn how to extract, decode, and interpret data to uncover user activity and forensic artifacts.
advanced level
Dig deep into unsupported apps with hands-on SQLite analysis. Use Python to script, automate, and extract what tools miss. Gain a technical edge for advanced mobile forensics.
Training formats for every schedule
Real-world practice. However you choose to learn.
On-Demand Training
Learn when it works for you. 24/7 access to real-case modules. Pause, replay, and apply at your own pace.
Live Online Training
Join live sessions from anywhere. Ask questions, try out techniques, and learn by doing. All the energy of the classroom, without the commute.
Classroom Training
Learn in person from expert forensic practitioners through hands-on labs designed to build deep, practical skills.
Proven methods. Held up by results.
25+ Years of experience behind our training
100% focus on real-world case exercises in every course
5/5 average course rating from professionals
1000+ professionals trained, in 30+ countries
micro-learning | guides & e-books
Free guide
Forensic Guide to GPT Partitioning
This free guide provides a practical walkthrough of GPT-partitioned disks, covering the Protective MBR, GPT Header, and Partition Entry Array. It’s designed to help forensic professionals understand disk structures, recover data, and validate evidence.
FREE guide
Decrypt Locked Apple Notes on iOS 16.x
This guide provides a practical walkthrough for forensic analysts dealing with encrypted Apple Notes in iOS 16.x. It focuses on identifying and decrypting locked notes stored in the NoteStore.sqlite database extracted from iOS backups.
Trusted by investigators worldwide
The story behind Elusive Data
Our Story
After decades of solving cases, testifying in court, and training forensic teams around the world, James Eichbaum founded Elusive Data in early 2024.
Well known in the digital forensics community from his former roles as an investigator, Global Training Manager, and instructor for some of the leading names in the industry, James started the company with a clear idea: training should be more hands-on, immersive, and reflect the real challenges of daily investigations. It should also be more accessible, giving investigators faster access to the knowledge they need to act quickly, make sense of complex data, and solve cases without delay.
Today, Elusive Data helps professionals around the world learn through immersive, hands-on training. Courses include interactive labs, CTF challenges, and practical exercises built around real case data. Training is available on-demand, live online, and on-site.
Along the way, it became clear that some of the biggest challenges investigators face are more than just knowledge.
Gaps between what tools show and what investigators need to understand kept slowing work down.
That’s why Elusive Data also develops focused forensic tools: practical utilities built directly from training, casework, and day-to-day investigative needs — designed to remove friction, provide clarity, and support defensible analysis.
Elusive Data also supports active investigations through expert consulting and forensic services, for a field that never stands still.
digital forensics services
Digital forensics backup. From uncovering digital evidence to building resilient teams.
Operational support. Strategic strength. All-in-one forensic partner.
Digital Forensics Services
Get help uncovering and explaining digital evidence. We deliver clear, reliable results for investigations, legal cases, and internal reviews.
Digital Forensics Consulting
Build stronger forensic capabilities with expert guidance. From setting up labs to improving workflows. We help you work smarter, faster.
Our courses sharpen the way you investigate digital and mobile evidence. You learn full workflows that go beyond tool buttons — working with raw data, decoding app artifacts, and practicing authentic case scenarios. Labs and CTF challenges give you confidence to handle live investigations under real conditions.
We offer four certification programs: Introduction to Digital Forensics, Mobile Device Forensics, SQLite Forensics, and Python for Mobile Forensics. Each program builds practical skills that complement your existing tools and help you see more, find more, and deliver precise results that hold up in reports and courtrooms.
Yes. All training has been fully updated to match the current forensic landscape. That includes support for modern iOS and Android environments, new app structures, updated CTF scenarios, and deep dives into advanced topics like SQLite freelist recovery and manual decoding of WAL/SHM files.
Our tools are built to meet today’s forensic challenges. They don’t replace your trusted platforms — they extend them. Some give you quick answers when time is short, others open up evidence in ways no other tool can.
VarInt Calculator – Decode variable-length integers instantly from SQLite databases. No scripts, no guesswork. Just clear values when you need them.
Backup2FS – Transform iOS backups into structured, navigable file systems with hashes and metadata preserved. From confusion to clarity in one step.
SQLite Visualizer – A full forensic suite for database analysis. Visualize structures, follow deleted records across time, and recover hidden evidence from WAL, freelists, and unallocated space. Built from years of training and investigations, it reveals what standard tools often miss.
Together, these tools give you sharper insight, clearer reporting, and results that hold up in real investigations.
We built ED SQLite Visualizer because we needed a clearer way to investigate SQLite in real cases. Again and again, the same questions appeared: What was deleted — and when? Where did this record come from? How can I explain this in a report?
The tool fills that gap. It shows deleted records frame by frame, maps schema relationships as a visual canvas, and recovers data from WAL, freelists, and unallocated space. Born from casework and refined in hands-on labs, ED SQLite Visualizer makes forensic analysis faster, clearer, and easier to explain — especially when time is short.
ED SQLite Visualizer is not another database viewer — it’s a new way to explore forensic questions. Instead of rows and hex, you see the story inside the database.
Key capabilities include:
WAL Timeline Viewer – Watch database history unfold, record by record.
Smart Canvas Navigation – Visualize entire schemas as interactive maps.
Integrated Hex & Structure View – Explore freelists, overflow chains, and pages without losing context.
One-Click Recovery – Extract deleted data from WAL, freelists, and unallocated space.
Built-in Evidence Tools – Protect source data, verify with SHA1, and generate reports.
Shaped by real-world challenges and used in our certified SQLite training, ED SQLite Visualizer gives investigators a faster, more connected way to see what’s really in the data.
You can choose the format that fits your goals and schedule:
Micro-Courses: Short, focused live sessions (60–90 minutes) on specific topics like GPT, SQLite, and encrypted apps — ideal for fast, practical learning.
On-Demand Courses: Access certified, self-paced training 24/7. Replay labs, follow guided exercises, and apply techniques at your own speed.
Live Online Courses: Join expert-led classes in real time. Participate in case discussions, ask questions, and complete labs with instructor feedback.
Classroom Training: Learn face-to-face through immersive sessions and hands-on labs led by experienced digital forensics professionals.
Yes. All full-length courses include a verified certificate of completion and CPE credits, recognized by many professional bodies.
Our training supports all experience levels. You can start with foundational skills like acquisition and validation, or deepen your expertise with advanced techniques such as parsing app databases and scripting with Python for forensic automation.
No. They are built to simplify complex forensic tasks. Whether you’re decoding VarInts, navigating an iOS backup, or exploring database internals, the goal is to make the process faster, clearer, and easier to explain.
When you purchase SQLite Visualizer, a one-hour training session is included to help you get started right away. For those who want to go deeper, in-depth courses using the tool will be available across all our training formats — from live online to on-demand modules and classroom sessions.
Latest insights & updates
Elusive Data expands training formats to make digital forensics training more accessible
February 7, 2026
No Comments
Making digital forensics training more accessible Elusive Data was founded in early 2024 with a clear purpose: to make advanced digital forensics training more accessible,
Elusive Data releases SQLiteVisualizer™ and redefines how investigators see and recover app data
December 9, 2025
No Comments
PRESS RELEASE Stockholm, Sweden – December 9, 2025 Elusive Data has officially released SQLiteVisualizer™, a next-generation forensicplatform that gives investigators unprecedented insight into how mobile
VarInt Calculator Now Available as an iOS App
September 29, 2025
1 Comment
Small time-savers can make a big difference in mobile forensics.
That’s why VarInt Calculator is now available as a dedicated iOS app—bringing fast VarInt decoding and clear SQLite insights straight to your iPhone or iPad.
ED SQLite Visualizer. See More, Miss Less.
July 22, 2025
No Comments
Something new is coming to mobile forensics At Elusive Data, our mission has always been clear: to help forensic professionals work faster, more accurately, and
Just Released: SQLite Data Structures Micro-Course On Demand
July 9, 2025
No Comments
New course out now: Gain control over app data like never before. Learn to uncover, validate, and defend hidden evidence — no waiting, no travel.
New Free Tool Release: VarInt Calculator – Simplify Mobile Artifact Analysis
April 27, 2025
No Comments
Instantly decode VarInts from mobile app databases with Elusive Data’s free forensic tool. Convert hex, binary, and decimal values for faster, more accurate investigations.
New Free Tool Release: Backup2FS – Normalize iOS Backups for Easier Analysis
April 27, 2025
No Comments
Discover Backup2FS, a free tool from Elusive Data that simplifies iOS backup analysis by normalizing backups into an easy-to-navigate file system.
Decrypt Locked Apple Notes on iOS 16.x: A Complete Forensic Workflow (SQLite, CyberChef, Python) Featuring Hashcat
March 27, 2025
2 Comments
Discover how I decrypted a locked Apple Note from an iOS 16.7.10 device using open-source tools like Hashcat, Python, and CyberChef. This step-by-step forensic workflow reveals the process behind extracting and decrypting hidden content from Apple’s Notes app. A must-read for digital investigators and mobile forensics professionals.
Thank you for a great course! I finally get how to work with unsupported apps. That clicked during this course. I’ve done a few trainings before, but this one stood out because it was actually useful right away. The instructor explained how app data is stored in a way that made sense, and I really appreciated all the real examples. I’ve already used a few techniques in a current case.