We are launching the Elusive Data Training Academy, and with it a new training format we call Elusive Data Guided On-Demand. It is specialist digital forensics training that combines the flexibility of self-paced learning with practical work, structured guidance and continued access to support.
The idea is simple. On-Demand digital forensics training should let investigators learn when their schedule allows, and it should put them in front of real forensic data while they do it. Guided On-Demand is built around active learning, so learners work with forensic data, interactive exercises, downloadable evidence files and connected challenges while progressing through a structured course at their own pace.
Our first full program in this format is SQLite Forensics On-Demand, a 24 CPE specialist course for digital and mobile forensic investigators who want to understand, recover and validate SQLite data beyond the standard decoded view.
Three minutes inside SQLite Forensics On-Demand: the evidence files, the interactive workbenches and the connected casework that run through the course.
What is Guided On-Demand digital forensics training?
Elusive Data Guided On-Demand is our approach to self-paced specialist forensic training. Learners decide when they study and how quickly they progress, and the course provides a clear learning path, practical exercises and access to guidance throughout. It is designed for investigators who want the flexibility of an online digital forensics course together with the kind of practical material they would expect from hands-on instructor-led training.
In the full SQLite Forensics program, that includes:
- structured expert-led lessons
- realistic forensic training data
- interactive byte-level workbenches
- downloadable SQLite databases
- WAL and SHM training files
- practical recovery workflows
- connected CTF-style forensic challenges
- source-level validation exercises
- course-related support
- one complimentary one-hour instructor session
The learning model moves from explanation to examination to application. A concept is introduced, explored in the underlying data and then applied again in a practical forensic problem, so each subject is met three times in three different ways.
Why we built a different kind of On-Demand forensic course
Digital forensics is learned by working with the data, because the questions that matter appear once the examiner opens it. SQLite forensics is a good example. It is useful to understand what a database page, B-tree or WAL frame is, and it becomes far more useful when you can open the source data, identify the structure yourself and see how it relates to the evidence a forensic tool presents.
An examiner may need to answer questions such as:
- Where exactly was a SQLite record stored?
- Can a deleted SQLite record still be recovered?
- Does an earlier page version remain in the WAL?
- What can the SHM file tell us about WAL page versions?
- Is relevant data stored in a freeblock, freelist page or overflow page?
- Can a decoded result from a forensic tool be independently validated?
- Where in the source file did an important finding come from?
Those are practical forensic questions, and answering them takes practice with the underlying structures. That is what the program is built to give.
Hands-on SQLite forensics training
The flagship SQLite Forensics On-Demand course is designed around the work digital and mobile forensic examiners actually perform. Learners move progressively from SQLite fundamentals into record structures, page-level examination, recovery, WAL and SHM analysis, database reconstruction and source-level validation.
SQLite records, pages and B-tree structures
SQLite databases are structured collections of pages, and understanding those pages helps an examiner explain how a record was stored, how it changed and where relevant data may still remain. The training covers record headers, serial types, payloads, variable-length integers, page structures and the relationships between records and the B-tree structures that contain them.
Learners work with the bytes directly, so that a decoded value can always be connected back to the position it came from in the source.
SQLite deleted record recovery
One of the most common questions in SQLite forensics is whether deleted or historical data can still be recovered. The answer depends on what remains in the source database and its related files, and the course introduces recovery-oriented workflows involving:
- freeblocks
- freelist pages
- unallocated and residual structures
- fragmented content
- overflow pages
- WAL page versions
Recovery is always dependent on what is still present. Data that has been overwritten or is no longer available in the source cannot be recovered simply because a recovery method exists. Our guide on recovering deleted SQLite records goes through the same ground in shorter form.
SQLite WAL and SHM forensics
SQLite Write-Ahead Logging can be decisive in a forensic examination, because database changes may exist in the WAL before, during or after they are reflected in the main database. The course teaches learners how to examine WAL frames, page versions, checkpoints and the associated SHM structures, and how these files add context that the main database alone does not carry.
For investigators who want to focus on this area, the Academy also includes a dedicated SQLite WAL & SHM Forensics micro-course.
Database reconstruction and damaged SQLite databases
Forensic data arrives in every condition, and part of the work is knowing what to do when a database is incomplete or damaged. Learners develop an understanding of how SQLite pages relate to one another and how database structures can be examined when the file cannot simply be opened and queried in the usual way.
Source-level validation
Validation runs through the whole program. A forensic tool presents a decoded value, and the examiner often still needs to know where that value came from and whether the interpretation holds when it is checked independently.
Learners practice tracing findings back to the relevant source context, including the file, page and byte-level structures involved. The aim is to be able to explain not only what was found, but also where it came from and how the finding was validated.
Interactive byte-level forensic workbenches
One of the things we wanted in Guided On-Demand from the start was the ability to work with data directly inside the learning environment. The Academy includes interactive byte-level workbenches where learners examine SQLite structures as part of the lesson itself, so a record header can be inspected, its fields identified and the interpreted values connected back to their position in the source data.
These exercises are particularly useful when learning about:
- SQLite varints
- serial types
- database and page headers
- SQLite records
- freeblocks
- freelist pages
- WAL structures
- byte offsets and source validation
The goal is not to turn a forensic examiner into a database developer. It is to make the structures clear enough that the examiner can investigate, validate and explain what the data shows.
Download the forensic training files and use your own tools
The evidence files used in the course can be downloaded, including the SQLite databases and the supporting WAL, SHM and related files used throughout the exercises. Learners can take those same files into their own forensic platforms, database tools or utilities, compare the results and keep practicing outside the course environment.
For investigators already working with commercial mobile forensic tools, this builds a direct connection between what the tool presents and what exists in the underlying SQLite data.
Connected digital forensics CTF challenges
SQLite Forensics On-Demand includes connected CTF-style forensic challenges that build on the techniques introduced throughout the program and place them inside a continuing investigation. The challenges ask the learner to apply a technique where the skill has to work, which is the point at which knowledge becomes capability.
A learner may need to:
- inspect the source data
- identify the relevant SQLite structure
- recover or interpret the finding
- validate it against the source
- use the result to move the investigation forward
This connects technical knowledge with investigative decision-making, so each lesson feeds the next instead of standing on its own.
Self-paced forensic training with access to instructor support
Flexibility is one of the main reasons investigators choose On-Demand training, and the questions that come up while working through forensic data deserve an answer. That is why course-related support is available while learners progress through SQLite Forensics On-Demand, and why the full program includes one complimentary one-hour instructor session during the course access period.
The session can be used to discuss a difficult topic, clarify course material or explore an area of SQLite forensics in greater depth with the instructor. This combination of independent study and direct access to guidance is the heart of what we mean by Elusive Data Guided On-Demand.
Three months of access, so training fits around casework
SQLite Forensics On-Demand includes three months of course access. Casework, court commitments, examinations and operational priorities continue while training is taking place, and few practitioners can clear a calendar for several weeks at a time.
The On-Demand format is built for that reality. A learner can complete a lesson, practice with the evidence files, return to a difficult subject later, compare the same data in another forensic tool and continue when the schedule allows.
Who is SQLite Forensics On-Demand for?
The course is designed primarily for digital forensic and mobile forensic practitioners who encounter SQLite databases in extracted application data. SQLite is used extensively by mobile and desktop applications and can hold messages, application records, location information, account data, metadata and other potentially relevant evidence.
The training is particularly relevant when an examiner needs to go beyond the standard decoded output, for example when:
- an application or version is not fully supported
- the application schema has changed
- historical or deleted records may remain
- results from forensic tools need validation
- different tools produce conflicting results
- a critical finding needs to be traced back to its source
It is also useful for laboratories that want consistent SQLite capability across a team rather than in one or two specialists.
Do I need SQL, Python or programming experience?
SQLite Forensics On-Demand is designed for forensic investigators rather than database developers. Previous digital forensic knowledge is useful, and advanced SQL, Python, coding or scripting experience is not required.
The underlying structures are introduced progressively and connected to practical forensic examples, so learners can see why each concept matters to an investigation before the next one arrives. Investigators who want to build scripting skills separately can look at Python for Mobile Forensics.
A complete 24 CPE SQLite forensics course
The full SQLite Forensics On-Demand program is equivalent to three days of instructor-led training and provides 24 CPE credits together with a certificate of completion. It covers a broad SQLite forensic workflow, including:
- SQLite architecture and B-tree structures
- database headers and page headers
- SQLite records and serial types
- variable-length integers
- freeblocks and freelist pages
- overflow pages
- SQL queries in forensic analysis
- database reconstruction
- deleted record recovery
- SQLite WAL analysis
- SQLite SHM analysis
- source-level validation
- forensic interpretation and explanation
Who teaches SQLite Forensics On-Demand?
The course is designed and taught by James Eichbaum, Co-Founder and Head of Product & Training at Elusive Data. James has spent more than 17 years teaching digital and mobile forensics and has trained thousands of forensic professionals in more than 30 countries.
His background includes law enforcement casework, mobile device investigations, advanced forensic training and forensic product development, and before co-founding Elusive Data he served as Global Training Manager at MSAB. The course reflects that practitioner background, so technical concepts are consistently connected back to investigative work, validation and the need to explain how a conclusion was reached.
The Elusive Data Training Academy
The Elusive Data Training Academy is the home of our Guided On-Demand training, and it launches with three SQLite forensics courses.
SQLite Forensics On-Demand
Our flagship 24 CPE program for investigators who want the complete learning path, from SQLite structures and records through recovery, WAL and SHM analysis, validation and source-level examination. See the full course details.
SQLite Data Structures
A focused micro-course for investigators who want to understand how SQLite databases are organized, how records are stored and how the underlying structures relate to forensic interpretation. Open it in the Academy.
SQLite WAL & SHM Forensics
A focused micro-course for practitioners who want to concentrate on SQLite Write-Ahead Logging, SHM structures, page versions and transaction-related forensic analysis. Open it in the Academy.
The Academy will keep growing with additional courses, practical exercises and challenge-based training.
Guided On-Demand or instructor-led digital forensics training?
Guided On-Demand and instructor-led training solve different needs, and both remain available. Guided On-Demand is a strong fit for individual examiners, distributed teams and practitioners who need to learn around operational work.
Instructor-led SQLite Forensics training is delivered Live Online and On-Site for teams that want a scheduled course, direct live interaction and a shared classroom experience. Both formats are built around the same objective, which is practical forensic capability that holds up in a real investigation.
Should I take the full SQLite Forensics course or a micro-course?
The two micro-courses suit an investigator who wants to focus on one part of SQLite forensics. For the complete workflow, SQLite Forensics On-Demand is the primary course, because it connects the individual subjects into a single investigative method:
Structure → interpretation → recovery → WAL/SHM → validation → explanation
That connection matters because a real examination rarely presents one isolated SQLite problem. A single finding may require understanding how a record was stored, identifying an earlier page version in the WAL, recovering residual data and then validating the result against the original source structure. The full program is built to connect those steps.
Where SQLite Forensics fits in the Elusive Data training path
SQLite Forensics is one part of a wider training path, and the right starting point depends on where you are today.
- Introduction to Digital Forensics, 40 CPE. A working foundation in evidence collection, file systems, examination and clear reporting. Start here if digital forensics is new to you.
- Mobile Device Forensics, 24 CPE. Practical skills in mobile acquisition, app data examination and forensic reporting.
- SQLite Forensics On-Demand, 24 CPE. The specialist path into records, pages, recovery, WAL and SHM analysis and source-level validation, at your own pace.
- SQLite Forensics, Live Online or On-Site. The same specialist subject as a scheduled instructor-led course for a team.
- Python for Mobile Forensics, 24 CPE. Build scripts that parse app data and make repeatable forensic tasks easier to carry out.
- Capture the Flag challenges. Put the methods to work on scenario-based investigations.
You can see every format, delivery option and course on the digital and mobile forensics training page.
Start with SQLite Forensics On-Demand
If you work with mobile device extractions, application databases or SQLite-based evidence and want to understand what sits behind the decoded output, the full SQLite Forensics On-Demand program is the place to start in the Academy. You work through it on your own schedule, with structured guidance, realistic evidence files, interactive byte-level workbenches, connected forensic challenges and course-related support.
24 CPE · 3 months access · certificate of completion · Elusive Data Guided On-Demand
Frequently asked questions about SQLite Forensics On-Demand
What is Elusive Data Guided On-Demand?
Elusive Data Guided On-Demand is our self-paced specialist training format. It combines structured lessons with hands-on exercises, downloadable forensic training files, connected CTF-style challenges and access to course-related support.
What does SQLite Forensics On-Demand include beyond video?
The program includes instructor-led video lessons, interactive byte-level exercises inside the lesson, downloadable SQLite, WAL and SHM evidence files, practical recovery and validation work, and connected CTF-style challenges that run through the course.
Is this an online digital forensics course?
Yes. The course is delivered through the Elusive Data Training Academy and is completed online at the learner's own pace during the course access period.
How long is SQLite Forensics On-Demand?
The full program is equivalent to 24 hours of training and provides 24 CPE credits. Learners receive three months of access to complete it.
What is included, and where do I find the price?
SQLite Forensics On-Demand is purchased per student and includes 24 hours of equivalent training, 24 CPE credits, three months of access, course-related email support, one complimentary one-hour instructor session and a certificate of completion. Current pricing is shown on the SQLite Forensics On-Demand course page, and Elusive Data can prepare a quotation for a team.
Does the course cover SQLite deleted record recovery?
Yes. The program includes recovery-oriented SQLite workflows involving freeblocks, freelists, overflow pages, residual structures and WAL-related data, where relevant information remains available in the source.
Does the course cover SQLite WAL and SHM analysis?
Yes. WAL and SHM analysis form an important part of the full program, and a dedicated SQLite WAL & SHM Forensics micro-course is available in the Academy for learners who want to focus on those structures.
Can I ask an instructor questions?
Yes. Course-related support is available while learners progress, and the full program includes one complimentary one-hour instructor session during the course access period.
Do I need SQL or programming experience?
The program is designed for forensic investigators, and advanced SQL, Python, coding or scripting experience is not required. Previous digital forensic knowledge is useful.
Can I download the SQLite training files?
Yes. The training files can be downloaded, so learners can examine the same SQLite, WAL, SHM and related evidence in their own forensic tools and workflows.
Who is the course designed for?
The course is designed for digital forensic investigators, mobile forensic examiners and other practitioners who need to understand, recover, interpret or validate SQLite-based application data.
Is live SQLite forensics training still available?
Yes. Instructor-led Live Online and On-Site SQLite Forensics training remains available for teams that prefer scheduled delivery.
