escalite

SQLite forensic tool, developed to make the analysis of SQLite databases easier. Primarly used for an university course about IT forensic but probably also useful for CTFs and other use cases. No guarantee of completeness or correctness.

All classes are combined in one file to make the program as portable as possible. Python libraries that are not part of the standard python installation are optional (for example graphviz).

PR & Issues

If you find something that is wrong interpreted or not supported at all, please open an issue and describe the missing feature, where it is documented and if possible provide a database to test with.

If you implemented the missing feature yourself, I will happily accept your pull-request.

Usage

./escalite.py <database>

Interactive

cmd	Description
`help`	Show available commands
`h`	Show DB header information
`o`	Show overview of all pages
`b <n>`	Show a graph of the BTree of Page n (Default: n = 2)
`p <n>`	Show information about the n-th page
`pc <n>`	Show all cells on page n
`pr <n>`	Try to retrieve deleted data on page n
`pd <n>`	Print hexdump of page n
`f <n>`	Show information about freelist trunk page n
`fcl <n>`	Check if freelist-leaf page n is empty
`fl`	Show freelistgraph
`exit, q`	Close program

Examples graphs

Freelist graph: Large empty database

BTree graph: Large database (test_fl.db)

BTree graph: Large database 2(test_fl2.db)

Features planned

BTree-graph generation In progress
- Interpret first pages to get overview of btree starts
Print hexdump of bytes proofing a interpretation of bytes (cmdline-argument)

nicolas93/escalite