Elusive Data is introducing a new training format, Elusive Data Guided On-Demand, with SQLite Forensics On-Demand as the first full program to use it.
The course builds on a strong and well-established foundation. James Eichbaum has spent more than 17 years teaching digital and mobile forensics, with SQLite forensics as one of his core subjects. Elusive Data has offered its own SQLite Forensics course for the past two years, and many practitioners have completed it through its instructor-led and On-Demand formats. From the beginning, the course has combined a structured path, downloadable evidence files and interactive byte-level workbenches. Elusive Data has now taken the next step by developing that proven approach into a complete Guided On-Demand format. Learners can study on their own schedule while staying connected to James as their instructor through the course chat, more connected CTF challenges, new animated exercises and one complimentary hour with him. Together, these elements create an experience that goes beyond traditional on-demand training and keeps guidance present throughout the learning journey.
We sat down with James Eichbaum, Co-Founder and Head of Product & Training at Elusive Data, who designed and teaches the course and guides learners throughout it.
How Guided On-Demand develops the learning experience
- A course chat. Learners can ask questions as they work, with answers usually coming directly from the instructor within a few hours and, in practice, on the same working day.
- More connected CTF challenges. Learners apply each technique within one continuing investigation, building the case as they progress through the course.
- Animated exercises. Each structure is shown being read step by step, in time with the explanation, before the learner works through it themselves.
- One complimentary hour with the instructor. Learners can book the session at the point during their access period when it will be most useful to them.
These additions build naturally on the guidance already embedded in the course: a clear, structured path, downloadable SQLite databases with their WAL, SHM and sidecar files, and interactive byte-level workbenches inside the lessons. The result combines the flexibility of on-demand learning with the continuity, practice and instructor connection that help learners keep moving forward.
Interview with James Eichbaum
The course was already guided and well received. What inspired you to take the experience further?
I have always designed the course to guide learners through the subject in a clear sequence. They work with real evidence files, use the byte-level workbenches and apply what they learn as they progress. We could see that this approach worked, and learners told us they were gaining real value from it. The next step was to bring even more of the connection I have with learners in a live classroom into the On-Demand experience. Guided On-Demand gives me more ways to stay present throughout the course, answer questions as they arise and help each learner connect the individual techniques to a complete forensic workflow.
So Guided On-Demand builds on the way you have taught the course from the beginning?
Exactly. It gives a name and a fuller framework to the approach we have been developing throughout the course. Learners still have the freedom to study when it suits them, and they now have even more guidance around that learning. The chat keeps the conversation close to the work, the animations let me walk through a structure visually, the connected challenges carry the investigation forward, and the one-to-one hour gives us space to explore the learner's own questions in more depth. I am their instructor throughout, even though they choose their own schedule.
How does the course chat support the learner's progress?
It keeps the learning moving while the question is still fresh. If someone has a database open and wants to understand a result, they can ask there and then. In the course chat they are usually talking to me directly, and I normally answer within a few hours on the same working day. That gives us a very natural exchange around the learner's actual work and helps them continue with confidence.
How do the animated exercises help learners understand the structures?
They let me slow down the exact moment that matters. With a structure such as a record header, the learner can watch it being read field by field at the same pace as the explanation. The workbench then presents the same kind of structure and invites them to work through it themselves. That sequence of seeing, understanding and doing makes the bytes feel much more approachable and gives the learner a clear path into the practical work.
How do the connected CTF challenges turn techniques into casework?
They place each technique inside a continuing investigation. The learner decides which step to take, carries it out, checks the result and then uses what they found. That is the kind of thinking examiners apply in real work. Because the challenges are connected, a finding in one part of the course can shape what the learner looks for next. It creates a sense of progression and helps individual skills come together as an investigative workflow.
Why was SQLite Forensics the first full program in the new format?
SQLite is especially well suited to learning through seeing and doing. A clear explanation gives the learner the foundation, and working directly with the bytes turns that understanding into a practical skill. SQLite also sits underneath so much app evidence that the techniques can be useful immediately, whichever forensic tools an examiner uses day to day. It was a natural course in which to bring every part of Guided On-Demand together.
Learners can download the evidence files and open them in their own tools. Why is that important?
Because it lets them make the same comparison they will make in an investigation. They can look at what their forensic platform presents, examine the same data at source level and understand the relationship between the two. The downloadable files also let learners continue exploring after a lesson and revisit the material in their own working environment. The goal is to give them the confidence to check, interpret and explain what they see.
What should an examiner be able to do by the end of the course?
Open the source data and understand what they are looking at. Recognize where historical or deleted material may remain and understand what determines whether it can be recovered. Trace an important finding back to the file, page and structure it came from. Then explain that work clearly to somebody who was not there, so the method, source and meaning of the finding can all be understood.
Which training route is the best starting point for different learners?
For someone beginning without a digital forensics background, Introduction to Digital Forensics provides a useful foundation before moving into SQLite. For a team that wants to train together on fixed dates and discuss the work as a group, the Live Online or On-Site course is designed for that setting. Guided On-Demand is ideal for individual examiners and distributed teams who want the same specialist subject with the flexibility to learn around casework. Each route is designed around a different way of learning.
What comes next for Guided On-Demand?
We will bring more courses into the format and continue developing the connected challenge material, because learners tell us that it makes the training feel like a real investigation unfolding over time. The two SQLite micro-courses are already available in the Academy for people who want to focus on one subject rather than the complete workflow. From there, we will keep developing the format around what practitioners want to learn and how they want to learn it.
Which training format fits you or your team?
Guided On-Demand and instructor-led training teach the same specialist subject to the same standard. Both provide a guided route through the material, with the time and instructor interaction arranged in different ways.
| Guided On-Demand | Live Online or On-Site | |
|---|---|---|
| When you study | On your own schedule, with three months of access | Together on fixed dates agreed in advance |
| Access to the instructor | Course chat, usually answered directly by James within a few hours on the same working day, plus one complimentary booked hour | Live throughout the course |
| Practice | Animated exercises, byte-level workbenches and connected CTF challenges | Guided labs with live discussion |
| Evidence files | Downloadable for continued practice after the lessons | Provided during the course |
| Best for | Individual examiners and distributed teams learning around casework | Teams that want to train together on set dates |
What is included in SQLite Forensics On-Demand
The program is equivalent to three days of instructor-led training. James guides learners from SQLite architecture, records, serial types and page structures into the places where historical or deleted material may remain, including freeblocks, freelists and overflow pages, and the factors that determine whether it can be recovered. The course then moves into WAL and SHM analysis, database reconstruction and source-level validation before bringing the skills together through interpretation and explanation.
- 24 hours of equivalent training and 24 CPE credits
- Three months of access and a certificate of completion
- Animated and interactive byte-level activities
- Downloadable SQLite, WAL and SHM training files
- Connected CTF challenges
- Course chat and one complimentary one-hour instructor session
About James Eichbaum
James Eichbaum is Co-Founder and Head of Product & Training at Elusive Data. He has spent more than 17 years teaching digital and mobile forensics and has trained thousands of forensic professionals in more than 30 countries. SQLite forensics is one of his core subjects. Before co-founding Elusive Data, he was Global Training Manager at MSAB, and his background includes law enforcement casework, mobile device investigations and forensic product development. James designed SQLite Forensics On-Demand and is the instructor guiding learners throughout the program.
Common questions about Guided On-Demand
What is Elusive Data Guided On-Demand?
Guided On-Demand is Elusive Data's flexible, instructor-guided specialist training format. It combines a structured course path with animated and interactive byte-level exercises, downloadable forensic evidence files, connected CTF-style challenges, a course chat and one complimentary one-hour session with the instructor. Learners choose when to study while guidance and instructor access remain part of the experience throughout.
How does the new format build on the previous On-Demand course?
The previous course already offered a guided learning path, downloadable evidence files and interactive byte-level workbenches. Guided On-Demand develops that foundation with a course chat, more connected CTF challenges, animated exercises that show a structure being read step by step, and one complimentary hour with the instructor. Together, these additions create an even more connected learning journey while preserving the flexibility learners value.
How quickly do I get an answer in the course chat?
Questions in the course chat are usually answered directly by James within a few hours and, in practice, on the same working day. The aim is to keep the conversation close to the practical work, so learners can continue while the database and the question are still fresh.
Which courses use the format today?
SQLite Forensics On-Demand is the first full program in the format. Two focused SQLite micro-courses are also available in the Elusive Data Training Academy.
How long do I have to complete it?
Learners have three months from the start of their access. The program is equivalent to 24 hours of training and carries 24 CPE credits and a certificate of completion.
What prior experience is helpful?
The course is designed for forensic investigators. Previous digital forensic knowledge is useful, and learners can complete the program without advanced SQL, Python, coding or scripting experience.
Is instructor-led SQLite training also available?
Yes. Live Online and On-Site SQLite Forensics training is available for teams that want a scheduled course, and every format is listed on the training page.
