SQLite might be the most important source of forensic relevant data we have access to right now. Many of our tools do a great job showing us the chats, the calls, the browser history, and even Windows Operating System information… but how does SQLite work below the data? In this presentation we will take a look at that low level area of the database including, the SQLite header, pages, and even what a VARINT is and how to work with them.
Presenter: Justin Tolman, Exterro
