A standardized corpus for SQLite database forensics. (March 2018)

• Record Type: Journal Article
• Authors: Nemetz, Sebastian; Schmitt, Sven; Freiling, Felix
• Is Part Of: Digital investigation. Volume 24(2018)
• Page Start: S121
• Page End: S130
• Publication Date: 2018-03
• Subjects: Digital forensics -- Database forensics -- Forensic corpora -- SQLite3; Forensic sciences -- Data processing -- Periodicals; Criminal investigation -- Data processing -- Periodicals; 363.250285
• DOI: 10.1016/j.diin.2018.01.015
• Languages: English
• ISSNs: 1742-2876

Abstract

Abstract: An increasing number of programs like browsers or smartphone apps are using SQLite3 databases to store application data. In many cases, such data is of high value during a forensic investigation. Therefore, various tools have been developed that claim to support rigorous forensic analysis of SQLite database files, claims that are not supported by appropriate evidence. We present a standardized corpus of SQLite files that can be used to evaluate and benchmark analysis methods and tools. The corpus contains databases which use special features of the SQLite file format or contain potential pitfalls to detect errors in forensic programs. We apply our corpus to a set of six available tools and evaluate their strengths and weaknesses. In particular, we show that none of these tools can reliably handle all corner cases of the SQLite3 format.