SQLite Forensics Data Structures micro-course

On-Demand: Access all 5 hours of content at your own pace. Ideal for working professionals who want flexibility to train between active cases.

Live Online: Instructor-led sessions conducted remotely. Timing can be customized for your team.

Yes — this course has been completely redesigned and updated for 2025. It reflects the latest findings, updated SQLite behavior, and modern forensic challenges based on real-world casework.

Yes! We offer flexible group training options — including discounted rates for teams of 5 or more. Agencies, labs, and organizations can request custom scheduling and onboarding support tailored to their needs.

Absolutely. We provide instructor email support so you can keep progressing confidently at your own pace.

Perfect. This course complements those skills by going deeper into database structures. You’ll learn what automated tools often overlook — like deleted records, freelist pages, and raw data reconstruction.

The course is led by Elusive Data’s senior instructor, James Eichbaum, a forensic specialist who has trained professionals from national police forces, federal, state and local law enforcement, government and military agencies, and global DFIR teams. You’ll learn from someone with deep, practical experience in real investigations. James has been teaching database forensics for over 15 years.

Yes. Every module includes interactive labs using real SQLite data. You’ll apply your learning immediately through guided exercises and downloadable datasets.

This microcourse was designed to fill a crucial gap in forensic training: understanding how SQLite databases actually store, structure, and retain data.

In just a few focused hours, you'll learn how records are laid out across fixed-size pages, how deleted data can persist in freelists, and how large entries are spread across overflow chains.

Through realistic examples and unsupported apps, you’ll work hands-on to decode headers, interpret VarInts, and trace records with precision.

Continuously updated and built for working professionals, this course delivers fast, focused, and practical training without cutting corners.

You should be comfortable navigating forensic tools and working with mobile artifacts, but you don’t need to be a developer. We’ll guide you through low-level concepts like freeblock parsing, varints, and freelist recovery with clear explanations and hands-on labs.

Yes. The course is certificate-based and designed by a former law enforcement examiner with real testimony experience. The workflows taught are courtroom-ready and built to hold up under review.

Yes. The course is built around real-world app data, not generic examples. You’ll learn practical workflows you can apply immediately — even when your tools fall short.

Great — this course is designed to work alongside them. You'll learn how to verify tool output, investigate unsupported apps, and recover evidence those tools often overlook.

No — if you later decide to enroll in the complete SQLite Forensics course, we’ll deduct the full cost of this microcourse from your total. Just reach out to us before enrolling in the full course.