{"id":26658974,"url":"https://github.com/denisecase/df-mod6-mobile","last_synced_at":"2025-04-11T14:09:46.205Z","repository":{"id":153899718,"uuid":"628355390","full_name":"denisecase/df-mod6-mobile","owner":"denisecase","description":"Mobile forensics using SQLite to explore browser contents","archived":false,"fork":false,"pushed_at":"2024-04-16T16:08:39.000Z","size":34341,"stargazers_count":2,"open_issues_count":0,"forks_count":12,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-25T10:17:15.791Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/denisecase.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-04-15T17:30:31.000Z","updated_at":"2024-03-03T01:15:16.000Z","dependencies_parsed_at":"2024-04-16T17:40:57.758Z","dependency_job_id":null,"html_url":"https://github.com/denisecase/df-mod6-mobile","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/denisecase%2Fdf-mod6-mobile","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/denisecase%2Fdf-mod6-mobile/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/denisecase%2Fdf-mod6-mobile/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/denisecase%2Fdf-mod6-mobile/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/denisecase","download_url":"https://codeload.github.com/denisecase/df-mod6-mobile/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248413745,"owners_count":21099352,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-03-25T10:17:27.089Z","updated_at":"2025-04-11T14:09:46.165Z","avatar_url":"https://github.com/denisecase.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# df-mod6-mobile\n\nMobile device forensics using SQLite\n\n- [GitHub](https://github.com/denisecase/df-mod6-mobile)\n\nThis respository includes files used in the Digital Forensics Challenge \ndescribed at [TSPD.md](TSPD.md).\n\n## Tools\n\n- VS Code\n- VS Code Extension: SQLite Viewer by Florian Klampfer\n- [DB Browser for SQLite](https://sqlitebrowser.org/)\n\nTo install an extension in VS Code, \ngo to the Extensions tab and search for the name and author. \n\nViewing tables in VS Code (or DB Browser) makes it easier to search and explore the organization.\n\n## Open Example Mozilla Broswer Evidence Folder\n\nWe have an example of Mozilla Firefox Browser Evidence Folder in the TSPD folder.\n\nClone, or fork and clone this repo down to your machine. \nLook for the [TSPD/j3uv3vkf.default/](TSPD/j3uv3vkf.default/) folder. \n\n## Databases (.sqlite) and Tables\n\nEach .sqlite file is a database. A database can have many tables. \nFor example, there is a database file named \n`places.sqlite`. \n\nThis database includes 13 tables. \n\nFor example, there is a  `moz_places` table in the places.sqlite database. \nThis table contains information about the user's browsing history, \nincluding the URLs visited and the date and time of the visit.\n\n## Explore Databases in VS Code\n\nYou can browse and search the database files in VS Code by clicking on them with the recommended extension installed.\n\nClick on a .sqlite file (pink icon) to open the table and search the data.\n\n## Explore Databases in DB Browser for SQLite\n\nIn DB Browser, use  File / Open Database to open a database file. \n\nUse the drop-down list to select a table in the database. \n\nUse the \"Execute SQL\" tab to run queries. \n\nFor example, you can run a SELECT statement to retrieve data from a table:\n\n```SQL\nSELECT * FROM moz_places;\n```\n\nWe can select just some of the columns - or limit our search to urls that contain http or https.\n\n```SQL\nSELECT url, title FROM moz_places;\nSELECT url, title FROM moz_places WHERE url LIKE '%http%';\n```\n\nInvestigators can use SQL queries to search for other types of information, \ne.g., credit card numbers and email addresses. \n\nWe can join tables together by matching fields and using the keyword `JOIN`.\n\nFor example, you can use the following query to search for email addresses:\n\n```SQL\nSELECT url, title FROM moz_places JOIN moz_bookmarks ON moz_places.id = moz_bookmarks.fk WHERE content LIKE '%@%' AND url LIKE 'http%';\n```\n\nThis query will search for email addresses in the URL or page \ncontent of websites that start with \"http\". \n\nAfter running a query, use the \"Save the results view\" icon (to the right of the red circle x ) to save as a CSV file.\n\nExample: out.csv\n\n## Optional SQLite CLI and PowerShell\n\nTo install SQLite CLI, see: \nhttps://www.sqlitetutorial.net/download-install-sqlite/\nDownload a file similar to: \nsqlite-tools-win32-x86-3410200.zip\n(1.91 MiB).\nExtract the files and move them as needed, so you have 3 .exe files in C:\\sqlite.\n\nOnce the CLI is installed, you can use PowerShell and PowerShell scripts to execute SQL. \nSee get_places1.ps1 for an example. To try it, open a PowerShell terminal and run:\n\n```PowerShell\n.\\get_places1.ps1\n```\n\nVerify that out1.csv is created. \n\n## Resources\n\n- [SANS DFIR Advanced Smartphone Forensics](https://www.sans.org/posters/dfir-advanced-smartphone-forensics/)\n- [Dataset construction challenges for digital forensics, 2021](https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=931168)\n- [GitHub: Android Forensics Resources](https://github.com/RealityNet/Android-Forensics-References)\n- [University of New Haven DATASETS FOR CYBER FORENSICS](https://datasets.fbreitinger.de/datasets/)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdenisecase%2Fdf-mod6-mobile","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdenisecase%2Fdf-mod6-mobile","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdenisecase%2Fdf-mod6-mobile/lists"}