How to Recover Deleted Data with Oxygen Forensic SQLite Viewer
Oxygen Forensics has released a stand-alone Oxygen Forensic SQLite Viewer, enabling forensic experts to view and export information stored by system and third-party mobile applications. The tool enables access to deleted SQLite records, and lays out the content of SQLite databases in a human-readable view.
Oxygen Forensic SQLite Viewer offers investigators a lighter, simpler and less expensive alternative to fully-featured forensic suites, enabling fast and easy SQLite viewing experience with no learning curve.
Viewing SQLite Databases
The majority of system and third party applications in Apple iOS, Android and BlackBerry 10 OS store their data and configuration settings in the SQLite format. Being an open format, SQLite does not impose any legal or technical restrictions, growing to a de-facto standard among mobile developers. Mobile operating systems such as Apple iOS, Android and BB10 OS make extensive use of SQLite format. Call logs, text messages, organizer events, chats, browsing history, logins and passwords and other important information is stored in the form of SQLite files.
Many desktop applications running in Windows and Mac OS X also utilize SQLite. Mozilla Firefox and Thunderbird, Skype, Yahoo Messenger, Chrome, Opera, Apple Safari, Picasa Explorer, Nokia PC Suite, Nokia OVI and many other applications keep their settings and histories in SQLite databases.
Oxygen Forensic SQLite Viewer parses the content of SQLite files produced by all applications utilizing the format, displaying all records in human-readable form. The built-in media viewer enables experts previewing images and video files embedded into SQLite records without launching external applications. Binary data can be viewed with the built-in HEX viewer.
SQLite stores date and time information in a binary, encoded format. Oxygen Forensic SQLite Viewer automatically converts date and time information from iOS/UNIX format into human-readable form, displaying both the original value as well as the converted date/time.
Investigating Deleted Data Evidence
With many web browsers, chats, instant and text messaging applications employing SQLite to keep conversation logs and histories, accessing conversations and messages deleted by the user becomes essential for a digital investigation. Similar to files deleted from a hard disk, deleted records in SQLite databases are not wiped completely until purged or overwritten with other data. This allows Oxygen Forensic SQLite Viewer analyzing clusters of deleted data, locating and recovering records that were once deleted. Access to deleted SQLite records enables investigators to read deleted Skype, WhatApp, Viber, etc conversations and analyze cleared browsing histories, access deleted call logs and read erased text messages.
The ability to recover deleted SQLite records is only available in few forensic tools such as Oxygen Forensic SQLite Viewer.
About Oxygen Forensic SQLite Viewer
Oxygen Forensic SQLite Viewer is a compact stand-alone tool allowing forensic experts exploring the contents of SQLite databases produced by system and third party mobile apps. Contacts, call logs, chats, system event logs, browsing data, configuration settings, backups and user’s personal information is stored by many Apple iOS, Android, BlackBerry 10, Symbian OS applications in the SQLite format. Many desktop applications such as Skype, Mozilla Firefox, Mozilla Thunderbird, Apple Safari, Opera, Nokia PC Suite and Nokia OVI use SQLite to keep user data, histories and configuration settings.
Oxygen Forensic SQLite Viewer automatically parses and displays the content of SQLite databases in human-readable form, offering an optional HEX view for binary data. Date and time information is automatically converted from Unix or iOS binary formats into human-readable form, while many types of images and video files can be previewed in-place without launching any external applications.
Unlike competing products, Oxygen Forensic SQLite Viewer offers the ability to analyze and recover information contained in deleted data records, allowing investigators to access deleted chat and browsing histories, retrieve erased text messages and recover all types of deleted records.
Read-only, zero-footprint operation with automatic hash calculation make Oxygen Forensic SQLite Viewer an ideal tool for digital forensic purposes. A report can be generated at any point in RTF, PDF, XML, XLS or HTML format. The tool is popular among government and law enforcement agencies, security services, and forensic organizations in multiple countries.
System Requirements
Oxygen Forensic SQLite Viewer runs in 32-bit and 64-bit versions of Windows XP, Windows Vista, Windows 7, 8, and 8.1. The tool has minimal hardware requirements, and only needs 15 MB of disk space to install.
More information about Oxygen Forensics and its forensic solutions is available at www.oxygen-forensic.com