SQLite Visualizer — SQLite forensiskt analysverktyg

SQLite Visualizer is an all-in-one SQLite forensic analysis tool built for digital investigators. It replaces six separate tools with a single workflow for WAL file analysis, freelist recovery, BLOB searching, and evidence validation.

Write-Ahead Log (WAL)-filvisare

SQLite Visualizer includes a dedicated write-ahead log viewer that parses WAL files frame by frame. View every frame in chronological order, identify which records are live in the database versus present only in the WAL, and detect pending deletions before they are permanently removed at the next WAL checkpoint.

Återskapa freelist-sidor och freeblock-data

When records are deleted in SQLite, their data moves to freelist pages and freeblocks. SQLite Visualizer recovers and displays this data automatically, allowing investigators to extract evidence from unallocated SQLite storage that other tools miss.

BLOB-textsök

Search keywords inside BLOB-encoded data — including plist, JSON, and protobuf content — directly within SQLite databases. Find evidence hidden in encoded fields that standard SQLite viewers cannot access. No exporting required.

Varint-avkodning och SQLite hex-analys

SQLite uses variable-length integers (varints) to encode record metadata. SQLite Visualizer includes a SQLite-native hex analysis engine with built-in varint decoding, page and frame navigation, and structure-aware templates designed specifically for forensic SQLite examination.

Identifiering av väntande raderingar

Pending deletions are records removed from WAL files that have not yet been permanently purged. SQLite Visualizer identifies these records before the next checkpoint destroys them — capturing evidence that would otherwise be permanently lost.

SQLite-analys av iOS- och Android-appar

SQLite Visualizer is optimized for mobile app forensics. Analyze SQLite databases from iOS and Android applications, decode app-specific formats including plists and protobufs, and recover data from WAL files and freelist pages created by mobile apps.

JSON Stitching — Återskapa fragmenterade konversationer

Mobile apps often store messages split across multiple SQLite records. SQLite Visualizer automatically stitches fragmented JSON conversation records back together into readable, complete chat threads — with markdown output ready for forensic reporting.

Validering av bevis

Validate findings from Cellebrite, MSAB, Oxygen, and other commercial extraction tools. Inspect raw SQLite page structures to confirm or challenge automated tool output before presenting evidence in court.