{"id":18637688,"url":"https://github.com/dutchcoders/forensics-sqlite","last_synced_at":"2025-04-11T10:30:48.424Z","repository":{"id":17358978,"uuid":"20130629","full_name":"dutchcoders/forensics-sqlite","owner":"dutchcoders","description":"Dumps frames of the -wal (write ahead log) file of sqlite databases.","archived":false,"fork":false,"pushed_at":"2014-05-24T14:23:41.000Z","size":143,"stargazers_count":19,"open_issues_count":0,"forks_count":8,"subscribers_count":7,"default_branch":"master","last_synced_at":"2023-08-03T21:05:33.056Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dutchcoders.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-05-24T13:54:07.000Z","updated_at":"2023-03-30T09:59:11.000Z","dependencies_parsed_at":"2022-08-04T18:30:30.238Z","dependency_job_id":null,"html_url":"https://github.com/dutchcoders/forensics-sqlite","commit_stats":null,"previous_names":[],"tags_count":0,"template":null,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dutchcoders%2Fforensics-sqlite","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dutchcoders%2Fforensics-sqlite/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dutchcoders%2Fforensics-sqlite/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dutchcoders%2Fforensics-sqlite/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dutchcoders","download_url":"https://codeload.github.com/dutchcoders/forensics-sqlite/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":223465964,"owners_count":17149765,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-07T05:37:26.564Z","updated_at":"2024-11-07T05:37:27.180Z","avatar_url":"https://github.com/dutchcoders.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"forensics-sqlite\n================\n\nDumps frames of the -wal (write ahead log) file of sqlite databases. The write ahead log is being written every once in a while to the real database. Using the write ahead log it will be possible to do forensics analyses on the history of the database (eg. modified records, added records etc.\n\nSQLite databases are often used mobile applications. \n\n\n## usage\npython ./test.py db.sqlite\n\n## references\n* http://sqlite.org/fileformat2.html\n* http://www.cclgroupltd.com/the-forensic-implications-of-sqlites-write-ahead-log/\n\n## sample\n```python\nimport struct\nimport sys\nfrom forensics_sqlite import DB, WAL\n\nif __name__ == '__main__':\n\twith open(\"{0}-wal\".format(sys.argv[1]), 'r') as f:\n\t\twal = WAL(f)\n\n\t\tprint (\"Version {:02x}\".format(wal.version))\n\t\tprint (\"Page size {:02x}\".format(wal.page_size))\n\t\tprint (\"Sequence {:02x}\".format(wal.sequence))\n\t\tprint (\"Salt1 {:02x}\".format(wal.salt1))\n\t\tprint (\"Salt2 {:02x}\".format(wal.salt2))\n\t\tprint (\"Checksum1 {:02x}\".format(wal.checksum1))\n\t\tprint (\"Checksum2 {:02x}\".format(wal.checksum2))\n\n\t\tfor (page_number, size_in_pages, salt1, salt2, checksum1, checksum2, page) in wal.frames():\n\t\t\tprint (\"Current position {0}\".format(f.tell()))\n\t\t\tprint (\"Page number {:02x}\".format(page_number))\n\t\t\tif size_in_pages\u003e0:\n\t\t\t\tprint (\"Commit: Size in pages {:02x}\".format(size_in_pages))\n\t\t\tprint (\"Salt1 {:02x}\".format(salt1))\n\t\t\tprint (\"Salt2 {:02x}\".format(salt2))\n\t\t\tprint (\"Checksum1 {:02x}\".format(checksum1))\n\t\t\tprint (\"Checksum2 {:02x}\".format(checksum2))\n\t\t\tprint (page)\n\n\n\twith open(sys.argv[1], 'r') as f:\n\t\tdb = DB(f)\n\t\tversion = { 1: \"Legacy\", 2: \"WAL\" }\n\t\tprint (\"{0} {1} {2} {3}\".format(db.signature, db.page_size, version[db.write_version], version[db.read_version]))\n\t\tpass #main (f)\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdutchcoders%2Fforensics-sqlite","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdutchcoders%2Fforensics-sqlite","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdutchcoders%2Fforensics-sqlite/lists"}