Learn SQLite forensics through a certified, hands-on training course built for professionals investigating mobile app data. Available On-Demand, Live Online and On-Site, it gives you the same depth, labs and case data in the format that fits your schedule. Updated for 2026, the course teaches you how to manually analyze and recover data that standard tools may miss, including deleted records, WAL files and unallocated space.
인증 교육
Learn SQLite Forensics through a certified, hands-on training course built for professionals investigating mobile app data. Updated for 2026, this course teaches you how to manually analyze and recover data that standard tools often miss, including deleted records, WAL files and unallocated space.
실제 시나리오와 새로운 CTF 과제를 중심으로 설계된 이 교육은 심층 포렌식 해석, 페이지 수준 디코딩, 고급 디지털 조사를 위한 실무 기술에 중점을 둡니다.
This course is for mobile forensic professionals ready to go beyond default tool output. It is ideal if you are familiar with standard forensic platforms and want a deeper understanding of what gets parsed and, just as importantly, what often gets left behind.
Basic digital forensic knowledge is helpful. Prior advanced SQLite or SQL experience is not required. The course is designed for investigators, not developers. Techniques are visual, practical and explained step by step.
A structured SQLite forensics course that moves from foundations and page-level analysis to deleted data recovery, database reconstruction, WAL/SHM interpretation and final assessment.
Identify SQLite structures, decode varints and serial types, and manually parse live and deleted records from database pages.
Build and manipulate a database, observe how evidence changes at the byte level, and begin recovering deleted records from freeblocks and freelist pages.
Complete reconstruction work, analyze transaction files, recover evidence not present in the main database and complete the final practical and knowledge assessment.
Want the full syllabus with the day-by-day structure?
Five practical modules covering SQLite fundamentals, internal structures, database creation, reconstruction, deleted data recovery and WAL/SHM analysis.
The course combines guided explanation with hands-on work, realistic datasets, practical recovery exercises and a final assessment.
Interpret SQLite structures and records without relying solely on automated tools.
Repair damaged or incomplete B-tree structures and validate the result.
Locate deleted data in freeblocks, freelist pages and transaction files.
Independently verify commercial tool output and explain how evidence is stored.
Explain what was recovered, where it came from and why it matters.
Demonstrate your skills by interpreting SQLite structures, recovering evidence and explaining findings.
Need help choosing the right training format?
This course is for mobile forensic professionals ready to go beyond default tool output. It is ideal if you are familiar with standard forensic platforms and want a deeper understanding of what gets parsed and, just as importantly, what often gets left behind.
Basic digital forensic knowledge is helpful. Prior advanced SQLite or SQL experience is not required. The course is designed for investigators, not developers. Techniques are visual, practical and explained step by step.
Want to see the full course outline?
This course is built to develop real forensic capability. You work hands-on with realistic data, solve investigative challenges and learn how SQLite behaves in real cases.
증거 발견부터 전문가 보고까지 실제 조사 과제를 해결하세요.
Learn methods you can apply across forensic platforms and manual validation workflows.
Use real datasets in virtual environments with standard forensic tools.
Extract deleted messages, media files and data fragments, even without tool support.
Understand B-trees, varints, serial types, freelists, overflow pages, WAL and SHM.
Learn to explain what was found, where it came from and how it was validated.
Not sure if this course fits your team?
James Eichbaum is a well known digital forensics instructor and practitioner with deep expertise in mobile forensics, SQLite analysis and real-world investigative workflows.
Over the past 17+ years, James has trained thousands of professionals in more than 30 countries, with a consistent focus on practical skills, investigative accuracy and defensible forensic interpretation.
He has led advanced forensic training programs for law enforcement, defense and private-sector teams worldwide, including national police agencies and forensic labs.
In this certified course, James guides you step by step through SQLite internals, from page structures and WAL files to deleted data recovery and validation, using structured labs, realistic app data and CTF-style challenges.
LinkedIn에서 James와 연결Want to review the course outline or discuss training?
Built around real-world forensic problems, practical recovery methods and clear interpretation of SQLite evidence.
The course is designed to make complex SQLite structures easier to understand, validate and explain without requiring coding or scripting experience.
The labs, case data and depth are the same. The only thing that changes is how you fit the learning into your schedule.
Self-paced training
Learn when it works for you, at your own pace, with access to the course content, videos, lab files and practical exercises.
Instructor-led remote training
Join live sessions from anywhere, ask questions in the moment and work through labs with instructor guidance.
In-person team training
Bring the course to your team with in-person training built around practical labs, discussion and your training goals.
Tell us whether you are looking for individual training or team delivery, and we will help you choose the right format.
Need manager approval? Download a short justification letter you can share with your manager, training coordinator or budget approver.
Download justification letterParticipants receive completion documentation for professional records, internal reporting, audits and continuing education requirements.
A signed certificate confirming completion of the Certified SQLite Forensics course.
Supports continuing education records for forensic, cyber and investigative professionals.
Participants complete both knowledge checks and hands-on practical work.
Suitable for internal documentation, training records and audit support.
The course supports practical skills, formal training records and repeatable forensic workflows that can be explained clearly.
Need confirmation about certification or CPE documentation?
A deep, practical training track for professionals who work with mobile extractions, forensic tools, app databases and SQLite-based evidence.
Over three days, or through the equivalent on-demand format, you learn how to read, interpret, recover and validate data directly from raw SQLite structures.
The training combines guided explanation with hands-on practice using realistic datasets, deleted records, freelist recovery, overflow content, WAL/SHM interpretation and CTF-style forensic challenges.
The course can be delivered as self-paced training, instructor-led live online training or on-site team training by request.
Want help choosing the right delivery format?
Answers to common questions about course format, pricing, certification, labs, delivery and technical level.
라이브: Delivered over 3 full days with instructor-led sessions, labs and interactive case studies.
온디맨드: The same core content in a self-paced format, equivalent to 24 hours of training.
Yes. The course content is updated for 2026 and reflects current SQLite forensic workflows, modern app data, WAL/SHM analysis and practical recovery scenarios.
The course is available On-Demand, Live Online and On-Site.
온디맨드: EUR 1,299 per student.
온라인 라이브: By quote, for groups of 3 or more.
온사이트: By quote, for groups of 5 or more.
Group rates are available.
Yes. Live Online and On-Site training are available for teams by request. We can help recommend the right format based on team size, delivery preference and training goals.
Basic digital forensic knowledge is helpful. Prior advanced SQLite or SQL experience is not required. The course explains SQLite internals visually, step by step, with practical labs and forensic use cases throughout.
No. The course is designed for investigators, not developers. Techniques are visual, practical and explained step by step. You do not need coding or scripting experience to complete the training.
Labs include parsing deleted records, rebuilding overflow chains, exploring WAL/SHM files, recovering fragmented content and solving scenario-based challenges using realistic forensic datasets.
The course is taught by James Eichbaum, a digital forensics instructor and practitioner with 17+ years of experience training law enforcement, forensic examiners, DFIR consultants and investigative teams worldwide.
This course complements commercial forensic platforms. You learn how to validate tool output, investigate unsupported apps and understand SQLite evidence beneath automated parsing results.
Participants receive a certificate of completion with 24 CPE credits. It is designed for professional records, internal documentation, audits and continuing education tracking.
Live participants can ask questions during sessions. On-Demand participants can contact us with course-related questions while working through the material.
Yes. The course is built around realistic app data, practical recovery workflows and forensic scenarios that map directly to mobile and application database investigations.
Yes. You work through CTF-style forensic challenges designed to reinforce technical SQLite concepts with practical investigation scenarios and realistic datasets.
It is a deep forensic course, but it is designed to be accessible. You go into SQLite internals such as WAL, B-trees, varints, freelists and overflow pages, with visual explanations and practical labs.
The labs use realistic app databases involving messaging, location, application activity, deleted records, WAL activity, fragmented content and unsupported or partially parsed app data.
Yes. Experienced examiners, trainers and tool specialists use the course to deepen their understanding of SQLite internals, deleted data recovery and validation workflows.
Yes. WAL and SHM analysis are core parts of the course, including how to interpret database changes, reconstruct timelines and identify data not present in the main database file.
Yes. The course focuses on SQLite forensic principles and validation methods that apply regardless of which forensic platform you use.
Yes. SQLite is used in desktop applications, IoT devices, browsers, cloud sync tools and many other systems. The recovery and validation skills apply anywhere SQLite appears.
SQLite remains central to modern app investigations. The course teaches the forensic methods behind SQLite analysis, including page-level interpretation, recovery and validation. Firefly carries the same principles into a broader forensic workspace for app data investigations across SQLite, RealmDB, LevelDB, IndexedDB and Apple Biome / SEGB.
이 집중 연습을 통해 수사관들은 iOS 16.x 기기에서 암호화된 Apple 메모를 추출하는 명확한 실습 기술을 습득할 수 있습니다. 기본 도구 출력을 뛰어넘도록 설계된 실용적인 단계별 프로세스를 따라 복잡한 사건을 효과적으로 처리할 수 있는 통찰력과 자신감을 얻게 될 것입니다.
특히 일관성이 없거나 익숙하지 않은 데이터베이스를 탐색할 때, 수동으로 VarInts를 디코딩하면 포렌식 프로세스가 병목 현상을 일으킬 수 있습니다. 이 도구는 해석 속도를 높여 더 심층적인 분석에 집중할 수 있도록 도와줍니다. 이 도구는 무료로 사용할 수 있으며 SQLite 내부를 직접 다루는 조사자를 위해 특별히 제작되었습니다.
Meet Firefly. One forensic workspace for app data investigations, built on provenance. Recover, interpret, validate and report evidence across SQLite, RealmDB, LevelDB, IndexedDB and Apple Biome / SEGB, with every finding traceable back to its source.
This article shows how protobuf varints differ from SQLite varints and why that distinction matters in mobile forensics. It includes a full hands-on walkthrough of decoding a protobuf blob, extracting fields, and decrypting the final message.
A transformative, certified program designed to take digital forensic professionals from basic experience to confident Python proficiency. Newly updated for 2026, this hands-on training teaches you to build your own scripts to extract, parse, and analyze hidden evidence from app data.
단일 SQLite 페이지에 이미지나 미디어와 같은 대용량 콘텐츠를 담을 수 없는 경우, 해당 데이터가 오버플로 페이지로 유출됩니다. 이 가이드에서는 조각난 레코드를 수동으로 복구하는 방법을 안내하여 일반적인 조각화 도구가 종종 간과하는 증거를 보여줍니다.
Be the first to hear about new training opportunities, new tools and updates, case-based blog posts, and practical insights. Our monthly newsletter is built to help you learn faster, solve cases smarter, and keep up in a field that never stands still.
가입하려면 이메일을 입력하세요.
이 요청은 완전히 구속력이 없습니다. 어떤 날짜가 적합한지, 얼마나 많은 참가자를 포함시키고 싶은지 알려주세요. 최적의 옵션을 함께 논의하기 위해 신속하게 연락드리겠습니다.
SQLite remains one of the most important storage formats in mobile app investigations, powering everything from chat histories and location data to app settings, cached media and application artifacts.
Forensic platforms are essential, but they do not always parse every structure, support every app or show where a result came from. Evidence can remain in WAL and SHM files, overflow pages, freelists, deleted records, custom schemas and fragments that require deeper interpretation.
As mobile apps change quickly, examiners increasingly face unsupported databases, incomplete decoding and artifacts that need independent validation. In those situations, SQLite knowledge helps determine what the data means, how it was stored and whether a finding can be explained.
Certified SQLite Forensics is not a tool-button course. It teaches the forensic reasoning behind SQLite evidence: where data is stored, how deleted records remain, how transaction files preserve changes and how findings can be validated when automated parsing is incomplete or unsupported.
More control when SQLite evidence is incomplete, unsupported or needs to be explained in a report, review or testimony.
Deleted records, fragments and unallocated content
Pages, records, B-trees, varints and schemas
Tool output, WAL/SHM activity and recovered data
Findings for reports, review and testimony
Certified SQLite Forensics is built for investigators who need to recover what standard views may miss, validate findings independently and explain SQLite evidence with confidence.
