[sleuthkit-users] New Open-Source Forensic Tool for SQLite Data Recovery

[Andrew Z. <sch...@gm...>]

Hi All,

As an editorial assistant in the International Journal of Cyber
Forensics and Advanced Threat Investigations (ISSN: 2753-9997), I
would like to highlight a new open-source tool presented recently in
the journal.

(FQLite) is a tool to find and restore deleted records in SQLite
databases. It, therefore, examines the database for entries marked as
deleted. Those entries can be recovered and displayed. It is written
with the Java programming language. The program can operate in two
different modes. It can be started from the command line (CLI mode). A
simple graphical user interface is also supported (GUI mode).

The program is able to search an SQLite database file for regular as
well as deleted records.

Official Project Webpage
---------------------------------
Check out the latest binary version (as a runnable jar-Archive) from
the official project homepage:
https://www.staff.hs-mittweida.de/~pawlaszc/fqlite/

Technical Background
------------------------------
On overview article highlighting the technical background of FQLite
can be retrieved from

Pawlaszczyk, D., & Hummert, C. (2021). Making the Invisible
Visible–Techniques for Recovering Deleted SQLite Data Records.
International Journal of Cyber Forensics and Advanced Threat
Investigations, 1(1-3), 27-41.
DOI: https://doi.org/10.46386/ijcfati.v1i1-3.17

Prerequisites
------------------
To run the tool you need at least a Java Runtime Environment 1.8 or higher.

Example Usage
---------------------
To run the FQLite in GUI mode the executable jar can normally be
started with a double-click on the jar-archive file. If this does not
work, since javaw is not linked correctly to .jar files, you can use
the command line as well:

$>java -jar fqlite.jar

To run the FQLite from the command line you can use the following command:

$>java -cp fqlite.jar fqlite.base.MAIN <database.db>

Licence and Author
--------------------------
Author: Dirk Pawlaszczyk paw...@hs...

FQLite for SQLite is bi-licensed under the Mozilla Public License
Version 2, as well as the GNU General Public License Version 3 or
later.

You can modify or redistribute it under the conditions of these licenses.

Best Regards
Andrew Zayine, Ph.D., CISSP, CISM, CRISC, CDPSE, PMP