Elusive Data digital forensics training
Popular Guided On-Demand Training

SQLite Forensics Training Guided On-Demand

  • 24 CPE course
  • 3 months access
  • Byte-level labs
  • Certificate
  • EUR 1,299 per student

Learn SQLite forensics on your own schedule through a clear, guided progression from explanation to practical investigation. Work at page and byte level through database structures, WAL and SHM analysis, deleted data where recoverable structures remain, and validation back to the source file, page and byte offset. Build a repeatable method for turning raw SQLite data into findings you can verify and explain, with your instructor, James Eichbaum, available in the course chat as you progress.

Start On-Demand Course Download Course Outline
See the Guided On-Demand course and simulated workstation With James Eichbaum
What does Guided On-Demand mean?

You choose when to study, but the course follows a clear path from explanation into practical forensic work. Guided lessons, interactive byte-level exercises, downloadable evidence files and connected CTF challenges build the workflow step by step.

Will I be on my own during the course?

No. James remains your instructor throughout the course and answers course-related questions in the course chat himself, usually within a few hours on working days. Course-related email support is also available, and you can book one complimentary one-hour session with James during your access period.

How long do I have access?

You have three months of course access, giving you time to complete the lessons, revisit complex topics and practice with the downloadable training files on your own schedule.

Who built the course?

The course was designed and is taught by James Eichbaum, Co-Founder and Head of Product and Training at Elusive Data. His background includes law enforcement casework, mobile device investigations, advanced forensic training and developing tools for forensic professionals. SQLite forensics is one of his core teaching subjects, with a focus on practical investigation, source-level validation and helping examiners understand the data behind their findings.

Read the Forensic Focus interview with James Connect with James on LinkedIn Read why we built the Guided On-Demand format

Why this course

Choose your pace. Follow a guided path.

Build practical SQLite forensic understanding through visual explanation, focused practice and instructor support.

Move step by step from concept to application. The practical work is done in free desktop tools such as HxD and DB Browser, with the included browser workstation covering selected labs. Firefly is shown where relevant and is not required. James remains your instructor throughout.

Understand visually

See pages, records, WAL and SHM concepts explained before working with the data.

Practice as you progress

Move from each explanation into focused activity while the concept is still fresh.

Use the tools you prefer

Any hex editor and database browser will do. Free options are linked, and selected labs also run in the browser workstation.

Ask James

James answers the course chat himself, usually within a few hours on a working day. Email support and one included instructor session are there too.

What the format gives you

A clear learning path that makes technical depth manageable and connects each concept to practical forensic work.

Workbench & CTFs

Trace the data. Test the interpretation. Work the case.

Move from a decoded value to the source bytes behind it, then apply the method in connected investigation challenges.

Use the interactive workbench to map a value to its source file, page and byte offset. Connected CTFs then ask you to assess what the data supports and decide what to examine next.

Trace the value

Follow decoded data back to the source bytes, page and byte offset.

Inspect the structure

See how headers, records and payloads connect within the SQLite source.

Test the interpretation

Compare what the decoded view shows with what the underlying structure supports.

Advance the case

Apply each technique where one result informs the next investigative step.

What this develops

A repeatable workflow for moving between decoded output, source-level validation and better-supported investigative decisions.

Skills you build

Examine, recover, validate and explain

Build practical SQLite skills you can carry directly into app-data investigations.

Progress from database structures to source-backed findings through focused labs, realistic cases and one investigation that develops throughout the course.

Examine structures

Read pages, records, varints, serial types, overflow and their source context.

Analyze WAL and SHM

Interpret frames and indexes, compare database states and identify relevant material.

Recover what remains

Locate and reconstruct deleted data where recoverable structures remain.

Validate and explain

Trace findings to the file, page and byte offset, then document what the evidence supports.

What you can do after the course

Use a repeatable method to turn raw SQLite data into findings you can verify, document and explain.

Course access and pricing

Start when it suits you. Build the complete SQLite workflow

Get the full Guided On-Demand course with three months to work through the lessons, practical exercises and connected investigation challenges at your own pace.

Progress from SQLite structures into WAL and SHM analysis, deleted material where recoverable structures remain, source-level validation and clear forensic explanation.

Complete Guided On-Demand course

EUR 1,299 per student

One learner license with three months of course access.

3 months access
24 CPE credits
Certificate included
Start On-Demand Course Download Course Outline

Buying for a team? Contact us about group access and training options.

Included with your course

Learn, practice and get help as you progress

The course combines the full technical path with practical data, a guided learning environment and direct access to your instructor.

Follow the full path

Work through SQLite structures, WAL and SHM analysis, recovery where structures remain, and source-level validation.

Work with the data

Use interactive byte-level activities, downloadable SQLite, WAL and SHM files, and connected CTF challenges.

Use the learning environment

The labs use a hex editor and a database browser. Free options are linked in the course, and the included browser workstation simulates them for selected labs.

Ask your instructor

James answers the course chat himself, usually within a few hours on working days. Course-related email support is included.

Included instructor time

Book one complimentary one-hour session with James during your three-month access period.

Your instructor

Learn from James Eichbaum

James Eichbaum is a well-known digital forensics instructor and practitioner with deep expertise in mobile forensics, SQLite analysis and investigative app-data workflows.

Over the past 17+ years, James has trained thousands of forensic professionals in more than 30 countries, with a consistent focus on practical skills, investigative accuracy and defensible forensic interpretation.

His background spans law enforcement casework, mobile device investigations, advanced forensic training and tool development. Before Elusive Data, James served as Global Training Manager at MSAB, where he developed and delivered advanced training for forensic professionals around the world.

In this Guided On-Demand course, James takes you through SQLite internals in a way that connects technical depth to casework: page and record structures, WAL and SHM analysis, deleted data where recoverable structures remain, validation and source-backed explanation.

Teaching approach

James explains complex SQLite concepts without reducing their technical depth. Each part of the course moves from explanation into practical work, helping you understand how a structure, recovery method or validation step supports a finding that needs to be explained.

Instructor support

Guidance as you progress

You set the pace, while James remains your instructor throughout.

Ask James as you work He answers the course chat himself, usually within a few hours on working days.
One hour, one to one Book one complimentary session with James during your course access period.

Course-related email support is included throughout your three-month access period, if you prefer email to the chat. Use the booked session to revisit a course topic or work through part of the training in more depth.

Start On-Demand Course

FAQ

Questions before you start?

Answers for investigators, team leads and training approvers considering SQLite Forensics Guided On-Demand.

Course and practical work

What you learn, how deeply the course goes and the environment used for practical work.

What is included in the full On-Demand course?

The course includes the complete 24 CPE learning path, expert-led lessons, interactive byte-level exercises, downloadable SQLite training files, connected CTF challenges, relevant activities in the browser-based simulated Windows workstation, instructor support and a certificate of completion. You have three months of course access.

Is this a shortened version of the SQLite Forensics course?

No. This is the complete 24 CPE SQLite Forensics program adapted for Guided On-Demand learning, not a shortened overview or microcourse. It covers SQLite structures, WAL and SHM analysis, deleted material where recoverable structures remain, and validation back to the source file, page and byte offset.

Who is the course for, and what experience do I need?

The course is designed for digital forensic examiners, analysts and investigators who work with app data. Basic digital forensic knowledge is helpful, but advanced SQLite, SQL, coding or scripting experience is not required. Technical concepts are introduced visually and reinforced through practical work.

What do I need before I start?

Access to a hex editor and a database browser. Any of them work: HxD, 010 Editor, Hex Workshop or a built-in Linux editor on the hex side, and DB Browser for SQLite, SQLite Expert Personal or the sqlite3 command line on the database side. The course links free options for both. The included browser workstation simulates these tools for selected labs, so it does not replace them for the whole course.

What tools will I use, and is Firefly included?

You work in a hex editor and a database browser of your choice, and the course links free options for both. One lesson rebuilds a record by hand and needs a hex editor. Our free varint calculator supports the first two lessons. The browser workstation holds realistic simulations of these tools for selected labs, not the tools themselves. Firefly is not included and is not required. It speeds up the labs if you already have it.

What files and practical activities are included?

You work with purpose-built SQLite databases, WAL and SHM files and related sidecar files. Interactive byte-level exercises help you inspect pages, records and raw structures, while connected CTF challenges ask you to apply the techniques within a developing investigation. The downloadable training files can also be examined in your own forensic tools.

Will this help if I already use forensic tools?

Yes. The course helps you understand what a parser surfaced, examine unsupported or changed app-data structures, test an interpretation against the underlying data and trace a finding back to its source file, page and byte offset. The aim is to help you use tool output with stronger source-level understanding.

Access, support and booking

How the guided format works, what support is included and the facts needed for a training decision.

What does Guided On-Demand mean?

You choose when to study, while the course follows a clear path from explanation into practical forensic work. Lessons, visual walkthroughs, exercises and connected challenges build the workflow step by step, and James Eichbaum remains your instructor throughout the course.

How long do I have access?

You have three months of course access. During that period, you can complete the lessons on your schedule, revisit technical topics and practice with the downloadable training files.

Will I be on my own during the course?

No. James answers the course chat himself, usually within a few hours on working days. Course-related email support is also available, and you can book one complimentary one-hour session with James during your three-month access period.

How much does the course cost?

The complete SQLite Forensics Guided On-Demand course costs EUR 1,299 per student.

Do I receive a certificate and CPE credits?

Yes. After completing the full course, you receive a certificate of completion and 24 CPE credits for your professional training record.

Can the training be arranged for a team or delivered live?

Yes. Organizations can purchase Guided On-Demand access for multiple learners. Private Live Online and on-site delivery can also be requested separately and are quoted according to the group and delivery requirements.

What the course covers

The complete 24 CPE SQLite Forensics program, adapted so you can work through it at your own pace.

Why this course

SQLite forensics explained step by step, from page and record structures to findings you can defend. Each concept is shown first and practiced while it is still fresh.

What you learn
  • Read pages, records, varints, serial types and overflow.
  • Interpret WAL and SHM frames and compare database states.
  • Recover deleted data where recoverable structures remain.
  • Trace every finding back to the file, page and byte offset.
How you practice

An interactive workbench takes you from a decoded value to the source bytes behind it. Connected CTF challenges then apply each technique to one investigation that develops through the course.

What is included
  • The complete 24 CPE learning path and expert-led lessons.
  • Interactive byte-level exercises and connected CTF challenges.
  • Downloadable SQLite, WAL and SHM training files.
  • Instructor support and a certificate of completion.
What do I need before I start?

Access to a hex editor and a database browser. Any of them work, and the course links free options for both.

The included browser workstation simulates these tools for selected labs. Firefly is not included and is not required.

Your instructor

James Eichbaum has taught digital and mobile forensics for more than 17 years in over 30 countries, previously as Global Training Manager at MSAB.

He answers the course chat himself, usually within a few hours on working days, and one complimentary one-hour session is included during your access period.

Is this a shortened course?

No. This is the complete 24 CPE SQLite Forensics program adapted for Guided On-Demand learning, not an overview and not a microcourse.

Who is it for?

Digital forensic examiners, analysts and investigators who work with app data. Basic forensic knowledge helps. Advanced SQLite, SQL, coding or scripting experience is not required.

Complete Guided On-Demand course

EUR 1,299

Per student. One learner license with three months of course access.

  • 3 months access
  • 24 CPE credits
  • Certificate
Start On-Demand Course Download Course Outline

Buying for a team? Contact us about group access

EUR 1,299 Per student
Start On-Demand Course
An earlier look inside the course

The technical depth remains. The learning experience has evolved.

This film introduces the core SQLite forensic work covered in the course. Guided On-Demand now builds a clearer path around it, with direct access to James in the course chat, more interactive exercises, connected CTF challenges, The Lab, a simulated Windows workstation for selected labs and a case that develops throughout the course.

For the current learning format, watch the Guided On-Demand video at the top of this page.

Course walkthrough

Inside the SQLite Forensics course

  • 3 minutes
  • Recorded 2025
  • With James Eichbaum

The film follows the technical path through the course, from the formats app data can contain to the SQLite structures an examiner needs to understand, test and explain.

  • App data and embedded formats Plists, XML, Base64 and Protocol Buffers found inside app data.
  • Page and byte level Database, page and record headers, serial types and the raw bytes behind a value.
  • Recovery where structures remain Freeblocks, freelists, overflow pages, and carving fragmented JPEG, PNG and other binaries.
  • Manual reconstruction Rebuild interior and leaf pages and use purpose-built databases to examine what happens as records are created and deleted.
  • WAL and SHM analysis WAL frames, SHM mappings, content that has not reached the main database, and deleted material that can still be present.
  • Practice and assessment Quizzes, practical labs, CTF-style challenges, a final assessment and a certificate.

SQLite forensics is not about running queries. It is about understanding how the data was stored, what changed or was deleted, and what can still be verified or recovered from the underlying structures.

Inside the course

What you work with from the first lesson to the final challenge.

Interactive workbench

Inspect SQLite structures, records, pages and byte offsets directly inside the lesson.

Downloadable evidence

Use the same SQLite databases, WAL and SHM files in your own forensic tools.

Connected CTF investigation

Apply each lesson in one investigation story that builds through the course.

Source-backed validation

Trace findings back to the file, page and byte offset so results can be explained and verified.

What professionals say about this course

Akira H.

Digital Crime Analyst
⭐️⭐️⭐️⭐️⭐️
This course went way beyond expectations. The explanation of WAL/SHM structures and manual recovery workflows gave me confidence to challenge tool limitations in real investigations.

Renata S.

Mobile Forensics Consultant
⭐️⭐️⭐️⭐️⭐️
I’ve taken many trainings, but none as immersive and practical as this. The combination of hands-on labs, CTFs, and SQLite internals made it incredibly valuable for my work with Android app data.

Jeroen V.

Cybercrime Unit Investigator
⭐️⭐️⭐️⭐️⭐️
Rebuilding freelist pages manually and decoding varints helped me crack a case just weeks after the training. James has a rare ability to explain complex topics clearly and practically.

Related content

Go deeper into the data with practical guides, tools and training.

Preview of the guide to decrypting locked SQLite forensics
Free guide

Decrypt locked SQLite forensics on iOS 16.x

Follow a practical, step-by-step workflow to examine and decrypt locked SQLite forensics using open-source tools. This guide applies specifically to iOS 16.x.

View guide
VarInt decoding example for SQLite forensic analysis
Forensic utility

VarInt Calculator

Decode variable-length integers, convert between hexadecimal and decimal, and inspect how values are stored. A practical utility for hands-on SQLite analysis.

Explore the tool
Elusive Data Firefly forensic workspace
Forensic software

Firefly: go beyond decoded output

Recover, interpret, validate and report supported app data in one forensic workspace. Keep findings connected to their source as you continue beyond decoded output.

Explore Firefly
Python and database analysis for digital forensics
Technical article

Protocol Buffers: the varint trap

Learn why protobuf varints differ from SQLite varints. Follow a hands-on walkthrough to decode a BLOB, extract its fields and reveal the final message.

Read article
Laptop with Python code and devices for forensic investigations
Certified training

Python for Mobile Forensics

Build practical Python scripts to extract, parse and analyze mobile app data. Develop repeatable workflows for unsupported formats and tasks that go beyond standard tools.

Explore the course
Diagram of SQLite overflow page chains
Technical article

SQLite overflow pages

Understand how large records span multiple SQLite pages. Follow overflow chains and reconstruct fragmented content that simple file carving can miss.

Read article

SQLite Forensics Guided On-Demand

Understand SQLite evidence from structure to source

SQLite Forensics Guided On-Demand is a 24 CPE self-paced course for digital forensic examiners who need to examine, validate and explain app-data findings beyond the decoded view.

What you learn

Work with SQLite file, page and record structures, varints and serial types, freelists, freeblocks, overflow pages, WAL and SHM analysis, and deleted material where recoverable structures remain. Validate findings to the source file, page and byte offset.

How you work

Follow guided lessons during three months of access, then apply each technique through byte-level exercises, downloadable training files and connected CTF challenges. The included browser-based simulated workstation lets you complete the practical work without installing anything. James Eichbaum answers the course chat himself, usually within a few hours on working days, and one complimentary instructor session is included.

Practical outcome A repeatable workflow for examining, validating and explaining SQLite findings from the underlying source.