Launching August 31, Firefly helps examiners recover, interpret, validate and report modern app data evidence with a clear path back to the source.
STOCKHOLM, July 21, 2026. Elusive Data today announced Ontwijkende Datasprinkhaan, a new forensic workspace for app data investigations, launching August 31, 2026.
Firefly is built for the work that begins after extraction: recovering deleted records where the data survives, reading app artifacts in context, validating decoded results against the source, and carrying that context into interactive HTML reports.
For years, app data examination has centered heavily on SQLite. Today, however, relevant evidence is often distributed across a much broader range of formats and structures. RealmDB, LevelDB, IndexedDB and Apple Biome / SEGB streams all play an important role, alongside BLOBs, timestamps, sidecar files, deleted structures and deeply nested data.
Even when a tool decodes that data, examiners still need to answer the question that matters when a finding is reviewed or challenged: where did this value come from, and can it be checked against the source?
Firefly is built around that question.
The workspace brings modern app data sources into one workflow, helping examiners recover what the data still holds, interpret it in context and trace findings back to the file, page and byte offset they came from.
At launch, Firefly will include support for SQLite, including encrypted SQLite, RealmDB, LevelDB, IndexedDB and Apple Biome/SEGB. Highlights include recovery of RealmDB stores used by apps such as Snapchat and Life360, animated replay of location history on a map, confidence-ranked timestamp interpretation across 17 formats, SEGBQL querying for Biome streams, and evidence-set validation using SHA-256.
Firefly builds on Elusive Data’s established SQLite Visualizer. Existing SQLite Visualizer customers keep the workflow they know and gain broader coverage across the databases and data structures modern apps use.
“Extraction gets the data out. The next question is where a finding came from, and whether it can be explained,” said James Eichbaum, Head of Product & Training and co-founder of Elusive Data. “Firefly is built around that answer. It keeps the interpretation and the source connected, so examiners can show their work when it matters.”
Elusive Data will host a live launch webinar on August 31, 2026, with a first walkthrough of Firefly. Investigators, labs and partners can learn more at elusivedata.io/firefly.
Over Elusive Data | Deskundige DFIR-training & Forensische Tools
Elusive Data builds forensic tools and training for investigators, grounded in real casework. Elusive Data Firefly is the company’s app data analysis workspace for recovering, interpreting, validating and reporting modern app data evidence.
Media contact:
Regina Hammarlund, Elusive Data
regina.hammarlund@elusivedata.io
