pjrinaldi / wombatsqlite

SQLite Forensic Tool

Wombat SQLite

SQLite Forensic Tool

SQLite forensic tool which will include tagging and html reporting for specific columns from rows from tables in a db. The tool will parse the db separate from the wal to distinguish between the different states/versions of the database and hopefully provide it in a meaningful output which will provide an indication of what changes occurred, i.e. update, insert, etc.

The goal is to provide a free gui tool which runs on linux and provides reporting features and some of the features similar to those from Sanderson forensics. I will also eventually incorporate this into a viewer for wombat forensics.

wombatsqlite's Issues

SelectionChanged Issue

If i use hte selectonChanged() signal for hex edit, and i want to clear the propwidget row selection, then it gets cleared when i select a row, since the hexedit selection changes...

need to figure out how to work around this or choose a different signal for the hexedit when i manually change the selection, maybe a mouse interaction one...

Tagging

Need to implement tagging for content rows.

Implement Interior Table (0x05)

need to implement parsing interior table (0x05)

Reporting

Need to implement reporting based on tags.

Implement Index Leaf - 0x0a

Need to implement parsing for index leaf (0x0a).

About Box

Need to implement about box

Parse WAL pages

Need to parse the WAL pages

Design

Working on how to lay out all the features/data for a sqlite content, i.e. page 1 header, tables, wal, journal, free pages, etc...

Switch from Qt to Fox Toolkit

Look into switching Wombat Sqlite from Qt to Fox Toolkit like i am doing with wombat registry.

Jump to Hex Offset

Need to add a jump to hex offset box either as a window or as an entry on the bit next to page spinbox.

Parse JOURNAL Pages

Need to parse journal pages

Implement Interior Index - 0x02

Need to implement interior index (0x02) parsing.

Parse Deleted entries from JOURNAL Pages

Need to parse the deleted entries from the journal pages.

Deleted/Overwritten Entries

Need to parse deleted/overwritten entries. Need to figure out how to get the area to parse, which i think is immediately before the cell content area - immediately after the cell array area.

Parse Deleted WAL Entries

Need to parse the deleted WAL entries on the WAL pages.