Learn SQLite forensics through a certified, hands-on training course built for professionals investigating mobile app data. Available On-Demand, Live Online and On-Site, it gives you the same depth, labs and case data in the format that fits your schedule. Updated for 2026, the course teaches you how to manually analyze and recover data that standard tools may miss, including deleted records, WAL files and unallocated space.
Certified training
Learn SQLite Forensics through a certified, hands-on training course built for professionals investigating mobile app data. Updated for 2026, this course teaches you how to manually analyze and recover data that standard tools often miss, including deleted records, WAL files and unallocated space.
Designed around real-world scenarios and new CTF challenges, the training focuses on deep forensic interpretation, page-level decoding, and practical skills for advanced digital investigations.
This course is for mobile forensic professionals ready to go beyond default tool output. It is ideal if you are familiar with standard forensic platforms and want a deeper understanding of what gets parsed and, just as importantly, what often gets left behind.
Basic digital forensic knowledge is helpful. Prior advanced SQLite or SQL experience is not required. The course is designed for investigators, not developers. Techniques are visual, practical and explained step by step.
A structured SQLite forensics course that moves from foundations and page-level analysis to deleted data recovery, database reconstruction, WAL/SHM interpretation and final assessment.
Identify SQLite structures, decode varints and serial types, and manually parse live and deleted records from database pages.
Build and manipulate a database, observe how evidence changes at the byte level, and begin recovering deleted records from freeblocks and freelist pages.
Complete reconstruction work, analyze transaction files, recover evidence not present in the main database and complete the final practical and knowledge assessment.
Want the full syllabus with the day-by-day structure?
Five practical modules covering SQLite fundamentals, internal structures, database creation, reconstruction, deleted data recovery and WAL/SHM analysis.
The course combines guided explanation with hands-on work, realistic datasets, practical recovery exercises and a final assessment.
Interpret SQLite structures and records without relying solely on automated tools.
Repair damaged or incomplete B-tree structures and validate the result.
Locate deleted data in freeblocks, freelist pages and transaction files.
Independently verify commercial tool output and explain how evidence is stored.
Explain what was recovered, where it came from and why it matters.
Demonstrate your skills by interpreting SQLite structures, recovering evidence and explaining findings.
Need help choosing the right training format?
This course is for mobile forensic professionals ready to go beyond default tool output. It is ideal if you are familiar with standard forensic platforms and want a deeper understanding of what gets parsed and, just as importantly, what often gets left behind.
Basic digital forensic knowledge is helpful. Prior advanced SQLite or SQL experience is not required. The course is designed for investigators, not developers. Techniques are visual, practical and explained step by step.
Want to see the full course outline?
This course is built to develop real forensic capability. You work hands-on with realistic data, solve investigative challenges and learn how SQLite behaves in real cases.
Tackle real investigative challenges from evidence discovery to expert reporting.
Learn methods you can apply across forensic platforms and manual validation workflows.
Use real datasets in virtual environments with standard forensic tools.
Extract deleted messages, media files and data fragments, even without tool support.
Understand B-trees, varints, serial types, freelists, overflow pages, WAL and SHM.
Learn to explain what was found, where it came from and how it was validated.
Not sure if this course fits your team?
James Eichbaum is a well known digital forensics instructor and practitioner with deep expertise in mobile forensics, SQLite analysis and real-world investigative workflows.
Over the past 17+ years, James has trained thousands of professionals in more than 30 countries, with a consistent focus on practical skills, investigative accuracy and defensible forensic interpretation.
He has led advanced forensic training programs for law enforcement, defense and private-sector teams worldwide, including national police agencies and forensic labs.
In this certified course, James guides you step by step through SQLite internals, from page structures and WAL files to deleted data recovery and validation, using structured labs, realistic app data and CTF-style challenges.
Connect with James on LinkedInWant to review the course outline or discuss training?
Built around real-world forensic problems, practical recovery methods and clear interpretation of SQLite evidence.
The course is designed to make complex SQLite structures easier to understand, validate and explain without requiring coding or scripting experience.
The labs, case data and depth are the same. The only thing that changes is how you fit the learning into your schedule.
Self-paced training
Learn when it works for you, at your own pace, with access to the course content, videos, lab files and practical exercises.
Instructor-led remote training
Join live sessions from anywhere, ask questions in the moment and work through labs with instructor guidance.
In-person team training
Bring the course to your team with in-person training built around practical labs, discussion and your training goals.
Tell us whether you are looking for individual training or team delivery, and we will help you choose the right format.
Need manager approval? Download a short justification letter you can share with your manager, training coordinator or budget approver.
Download justification letterParticipants receive completion documentation for professional records, internal reporting, audits and continuing education requirements.
A signed certificate confirming completion of the Certified SQLite Forensics course.
Supports continuing education records for forensic, cyber and investigative professionals.
Participants complete both knowledge checks and hands-on practical work.
Suitable for internal documentation, training records and audit support.
The course supports practical skills, formal training records and repeatable forensic workflows that can be explained clearly.
Need confirmation about certification or CPE documentation?
A deep, practical training track for professionals who work with mobile extractions, forensic tools, app databases and SQLite-based evidence.
Over three days, or through the equivalent on-demand format, you learn how to read, interpret, recover and validate data directly from raw SQLite structures.
The training combines guided explanation with hands-on practice using realistic datasets, deleted records, freelist recovery, overflow content, WAL/SHM interpretation and CTF-style forensic challenges.
The course can be delivered as self-paced training, instructor-led live online training or on-site team training by request.
Want help choosing the right delivery format?
Answers to common questions about course format, pricing, certification, labs, delivery and technical level.
Live: Delivered over 3 full days with instructor-led sessions, labs and interactive case studies.
On-Demand: The same core content in a self-paced format, equivalent to 24 hours of training.
Yes. The course content is updated for 2026 and reflects current SQLite forensic workflows, modern app data, WAL/SHM analysis and practical recovery scenarios.
The course is available On-Demand, Live Online and On-Site.
On-Demand: Get a quote for groups per student.
Live Online: By quote, for groups of 3 or more.
On-Site: By quote, for groups of 5 or more.
Group rates are available.
Yes. Live Online and On-Site training are available for teams by request. We can help recommend the right format based on team size, delivery preference and training goals.
Basic digital forensic knowledge is helpful. Prior advanced SQLite or SQL experience is not required. The course explains SQLite internals visually, step by step, with practical labs and forensic use cases throughout.
No. The course is designed for investigators, not developers. Techniques are visual, practical and explained step by step. You do not need coding or scripting experience to complete the training.
Labs include parsing deleted records, rebuilding overflow chains, exploring WAL/SHM files, recovering fragmented content and solving scenario-based challenges using realistic forensic datasets.
The course is taught by James Eichbaum, a digital forensics instructor and practitioner with 17+ years of experience training law enforcement, forensic examiners, DFIR consultants and investigative teams worldwide.
This course complements commercial forensic platforms. You learn how to validate tool output, investigate unsupported apps and understand SQLite evidence beneath automated parsing results.
Participants receive a certificate of completion with 24 CPE credits. It is designed for professional records, internal documentation, audits and continuing education tracking.
Live participants can ask questions during sessions. On-Demand participants can contact us with course-related questions while working through the material.
Yes. The course is built around realistic app data, practical recovery workflows and forensic scenarios that map directly to mobile and application database investigations.
Yes. You work through CTF-style forensic challenges designed to reinforce technical SQLite concepts with practical investigation scenarios and realistic datasets.
It is a deep forensic course, but it is designed to be accessible. You go into SQLite internals such as WAL, B-trees, varints, freelists and overflow pages, with visual explanations and practical labs.
The labs use realistic app databases involving messaging, location, application activity, deleted records, WAL activity, fragmented content and unsupported or partially parsed app data.
Yes. Experienced examiners, trainers and tool specialists use the course to deepen their understanding of SQLite internals, deleted data recovery and validation workflows.
Yes. WAL and SHM analysis are core parts of the course, including how to interpret database changes, reconstruct timelines and identify data not present in the main database file.
Yes. The course focuses on SQLite forensic principles and validation methods that apply regardless of which forensic platform you use.
Yes. SQLite is used in desktop applications, IoT devices, browsers, cloud sync tools and many other systems. The recovery and validation skills apply anywhere SQLite appears.
SQLite remains central to modern app investigations. The course teaches the forensic methods behind SQLite analysis, including page-level interpretation, recovery and validation. Firefly carries the same principles into a broader forensic workspace for app data investigations across SQLite, RealmDB, LevelDB, IndexedDB and Apple Biome / SEGB.
This focused walkthrough equips investigators with clear, hands-on techniques for extracting encrypted Apple Notes from iOS 16.x devices. You’ll follow a practical, step-by-step process designed to go beyond default tool output, giving you the insight and confidence to handle complex cases effectively.
Manually decoding VarInts can bottleneck your forensic process, especially when navigating inconsistent or unfamiliar databases. This tool speeds up interpretation, helping you stay focused on deeper analysis. It’s free to use and purpose-built for investigators working hands-on with SQLite internals.
Meet Firefly. One forensic workspace for app data investigations, built on provenance. Recover, interpret, validate and report evidence across SQLite, RealmDB, LevelDB, IndexedDB and Apple Biome / SEGB, with every finding traceable back to its source.
This article shows how protobuf varints differ from SQLite varints and why that distinction matters in mobile forensics. It includes a full hands-on walkthrough of decoding a protobuf blob, extracting fields, and decrypting the final message.
A transformative, certified program designed to take digital forensic professionals from basic experience to confident Python proficiency. Newly updated for 2026, this hands-on training teaches you to build your own scripts to extract, parse, and analyze hidden evidence from app data.
When a single SQLite page can’t hold large content like images or media, that data spills into overflow pages. This guide walks you through how to manually recover fragmented records, revealing evidence that typical carving tools often overlook.
Be the first to hear about new training opportunities, new tools and updates, case-based blog posts, and practical insights. Our monthly newsletter is built to help you learn faster, solve cases smarter, and keep up in a field that never stands still.
Fill in your email to sign up.
This request is completely non-binding. Let us know what dates might work for you and how many participants you’d like to include. We’ll get back to you promptly to discuss the best options together.
SQLite remains one of the most important storage formats in mobile app investigations, powering everything from chat histories and location data to app settings, cached media and application artifacts.
Forensic platforms are essential, but they do not always parse every structure, support every app or show where a result came from. Evidence can remain in WAL and SHM files, overflow pages, freelists, deleted records, custom schemas and fragments that require deeper interpretation.
As mobile apps change quickly, examiners increasingly face unsupported databases, incomplete decoding and artifacts that need independent validation. In those situations, SQLite knowledge helps determine what the data means, how it was stored and whether a finding can be explained.
Certified SQLite Forensics is not a tool-button course. It teaches the forensic reasoning behind SQLite evidence: where data is stored, how deleted records remain, how transaction files preserve changes and how findings can be validated when automated parsing is incomplete or unsupported.
More control when SQLite evidence is incomplete, unsupported or needs to be explained in a report, review or testimony.
Deleted records, fragments and unallocated content
Pages, records, B-trees, varints and schemas
Tool output, WAL/SHM activity and recovered data
Findings for reports, review and testimony
Certified SQLite Forensics is built for investigators who need to recover what standard views may miss, validate findings independently and explain SQLite evidence with confidence.
