Menu
Elusive Data’s SQLite Forensics course is built for digital forensic professionals who need to extract and interpret data from apps that commercial tools often miss. As third-party apps evolve quickly, conventional viewers fall short, missing evidence in WAL files, unallocated space, or complex schema structures.
This course bridges that gap with practical training in manual SQLite parsing, page-level decoding, and scripting-based validation. You’ll work with real-world cases and unsupported apps, learning how to recover deleted records, interpret data formats, and analyze database behavior.
You’ll also get unique access to Elusive Data’s custom-built SQLite forensics suite, developed specifically for this training. ED SQLite Visualizer transforms complex SQLite analysis into an efficient, visual process that reveals critical digital evidence previously left behind within mobile device databases.
This course is for mobile forensic professionals ready to go beyond default tool output. It’s ideal if you are familiar with standard forensic platforms and want a deeper understanding of what gets parsed — and, just as importantly, what often gets left behind.
This course is created by James Eichbaum, a former law enforcement examiner and one of the most experienced instructors in mobile forensics.
With over a decade of global training experience, including Global Training Manager at MSAB, he has trained thousands of professionals across 30+ countries, from local police units to national labs.
James has led real investigations and testified in court. His training reflects that experience: practical, structured, and focused on what actually works. Every lesson is designed to help you recover mobile app data manually, understand it, and explain it clearly. No matter if you’re writing a report, answering a QA review, or testifying on the stand.
Learn at your own pace with 25 hours of expert-led content. Flexible, self-guided learning.
Price per participant
Join instructor-led sessions remotely. Choose one of our scheduled classes or customize for your team.
Price per participant
On-site training for teams. We tailor delivery and scope to your organization’s needs. Contact us for a custom quote.
For teams
We’ve trained thousands of professionals, and these are the most common questions we hear before they enroll, from what’s in the course to how it fits into busy caseloads.
On-Demand: Access all 24 hours of content at your own pace. Ideal for working professionals who want flexibility to train between active cases.
Live Online: Instructor-led sessions conducted remotely. Timing can be customized for your team — from full-day intensives to shorter sessions across multiple weeks.
In-Person: Delivered onsite over 3 days. We tailor the format and depth to match your team’s availability, goals, and existing skill level.
No. You’ll get step-by-step guidance with just enough technical depth to understand and explain your findings — even if you're not a developer.
Yes. The course is certificate-based and designed by a former law enforcement examiner with real testimony experience. The workflows taught are courtroom-ready and built to hold up under review.
Yes. The course is built around real-world app data, not generic examples. You’ll learn practical workflows you can apply immediately — even when your tools fall short.
Perfect. This course complements those tools — not replaces them. You’ll learn how to validate, go deeper, and recover what your tools might miss.
This course is built for real-world mobile forensic work — not just theory. It goes deep into SQLite analysis, especially where tools fall short. You’ll learn to extract and explain data from unsupported or complex apps using courtroom-ready workflows.
Designed by a former law enforcement examiner and one of the most experienced trainers in the field, the course blends hands-on labs, real case examples, and structured learning you can apply immediately. It’s one of the few on-demand trainings that offers this level of depth, flexibility, and legal relevance — ideal if you're ready to specialize and build skills that stand up in court.
SQLite is still the most widely used database format in mobile applications. It stores everything from messages and geolocation data to app settings and cached content. While many forensic tools can parse basic structures, they often miss deeper layers of data hidden in write-ahead logs, unallocated pages, or app-specific schemas.
As mobile apps evolve faster than forensic software updates, examiners increasingly encounter unsupported or partially parsed data. This makes a deeper understanding of SQLite essential for accurate analysis.
Elusive Data’s course is designed with these real-world challenges in mind. You’ll learn how to decode and recover data manually, interpret database behavior, and validate evidence that default tools often overlook, especially in complex or time-sensitive investigations.
ED SQLite Visualizer was developed to enhance the way forensic professionals interact with SQLite data, both during training and in real investigations. This forensic suite was designed specifically for this course to complement the techniques you’ll learn and make advanced database analysis more accessible and efficient.
The suite brings together decoding, visualization, and interpretation in one interface. It simplifies the process of working with WAL files, varints, overflow pages, and structured records, helping you gain clearer insights into complex mobile app data.
You’ll use the tool throughout the course in labs and real-world scenarios, and you’ll keep it afterwards. It’s a resource you can rely on when examining app data, recovering deleted records, or validating findings with precision.
ED SQLite Visualizer reflects our belief that effective training should leave you with practical skills, and the tools to apply them right away.
Be the first to hear about new training opportunities, free tools, case-based blog posts, and practical insights. Our monthly newsletter is built to help you learn faster, solve cases smarter, and keep up in a field that never stands still.
Fill in your email to sign up.
Submit your request for Training. This is not a binding registration, we will get back shortly.
Thank you for a great course! I finally get how to work with unsupported apps. That clicked during this course. I’ve done a few trainings before, but this one stood out because it was actually useful right away. The instructor explained how app data is stored in a way that made sense, and I really appreciated all the real examples. I’ve already used a few techniques in a current case.