SQLite Visualizer — SQLiteフォレンジック分析ツール

SQLite Visualizer is an all-in-one SQLite forensic analysis tool built for digital investigators. It replaces six separate tools with a single workflow for WAL file analysis, freelist recovery, BLOB searching, and evidence validation.

Write-Ahead Log (WAL) File Viewer

SQLite Visualizer includes a dedicated write-ahead log viewer that parses WAL files frame by frame. View every frame in chronological order, identify which records are live in the database versus present only in the WAL, and detect pending deletions before they are permanently removed at the next WAL checkpoint.

Recover Freelist Pages and Freeblock Data

When records are deleted in SQLite, their data moves to freelist pages and freeblocks. SQLite Visualizer recovers and displays this data automatically, allowing investigators to extract evidence from unallocated SQLite storage that other tools miss.

BLOBテキスト検索

Search keywords inside BLOB-encoded data — including plist, JSON, and protobuf content — directly within SQLite databases. Find evidence hidden in encoded fields that standard SQLite viewers cannot access. No exporting required.

Varint Decoding and SQLite Hex Analysis

SQLite uses variable-length integers (varints) to encode record metadata. SQLite Visualizer includes a SQLite-native hex analysis engine with built-in varint decoding, page and frame navigation, and structure-aware templates designed specifically for forensic SQLite examination.

保留中の削除の検出

Pending deletions are records removed from WAL files that have not yet been permanently purged. SQLite Visualizer identifies these records before the next checkpoint destroys them — capturing evidence that would otherwise be permanently lost.

iOS and Android App SQLite Analysis

SQLite Visualizer is optimized for mobile app forensics. Analyze SQLite databases from iOS and Android applications, decode app-specific formats including plists and protobufs, and recover data from WAL files and freelist pages created by mobile apps.

JSON Stitching — Reconstruct Fragmented Conversations

Mobile apps often store messages split across multiple SQLite records. SQLite Visualizer automatically stitches fragmented JSON conversation records back together into readable, complete chat threads — with markdown output ready for forensic reporting.

証拠の検証

Validate findings from Cellebrite, MSAB, Oxygen, and other commercial extraction tools. Inspect raw SQLite page structures to confirm or challenge automated tool output before presenting evidence in court.