-
Notifications
You must be signed in to change notification settings - Fork 12
/
Copy pathreadme.txt
152 lines (97 loc) · 5.18 KB
/
readme.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
*******************************************************************************
* __________ __ _ __
* / ____/ __ \ / / (_) /____
* / /_ / / / / / / / / __/ _ \
* / __/ / /_/ / / /___/ / /_/ __/
* /_/ \___\_\/_____/_/\__/\___/
*
* FQLite - Forensic SQLite Data Recovery Tool
*******************************************************************************
FQLite is a tool to find and restore deleted records in SQLite databases.
It therefore examines the database for entries marked as deleted. Those
entries can be recovered and displayed. It is written in the Java programming
language.
The program can operate with a simple graphical user interface (GUI mode).
The program is able to search a SQLite database file for regular as well as
deleted records.
*******************************************************************************
### Features
*******************************************************************************
FQLite allows you to:
* browse and recover the content of freelist pages
* recover records in all database pages including unallocated space
* support of UTF-8,UTF-16BE,UTF-16LE encoded databases
* support for multi-byte columns as well as overflow pages
* recover dropped tables
* create CSV-format data export
* support for Rollback-Journals and WAL-Archives
* integrated Hex-Viewer
* support a forensically sound investigation of database files
* support for decoding of bplist, protobuffer and BASE64 encoded cell values
* automatic detection of different BLOB types like .png, .bmp, .gif, .jpeg, .tiff, .heic, .pdf
Some features:
* written with Java standard class library
* JavaFX-based graphical user interface
* open-source
* free of charge
* runs out of the box
*******************************************************************************
### Official Project Webpage
*******************************************************************************
Check out the latest binary version (for Intel as well as ARM-based systems)
from the official project homepage:
https://www.staff.hs-mittweida.de/~pawlaszc/fqlite/
*******************************************************************************
### Technical Background
*******************************************************************************
An overview article highlighting the technical background of FQLite can be
retrieved from
https://conceptechint.net/index.php/CFATI/article/view/17/6
D. Pawlaszczyk, C. Hummert: (2021).
Making the Invisible Visible – Techniques for Recovering Deleted SQLite Data
Records.
International Journal of Cyber Forensics and Advanced Threat Investigations,
*******************************************************************************
### Prerequisites
*******************************************************************************
In the latest version, the FQLite is bundled with a Java Runtime Environment(JRE)
and all required libraries.
> **Important note:** With version 2.0 the support for the command line mode was
cancelled.
*******************************************************************************
### Installation and Usage
*******************************************************************************
To run the FQLite in GUI mode the executable can normally be started with a
double-click on the run file. FQLite is written in Java. For the convenience
of the user, the runtime environment and all necessary libraries are included
and shipped with the install file. Just download the version for your system
environment and start immediately.
*******************************************************************************
Installation instruction MACOS
*******************************************************************************
First, download the DMG archive to your computer from this page. Double-click
the DMG file to open it, and you'll see a Finder window. Often these will
include the application itself, some form of arrow, and a shortcut to the
Applications folder. Simply drag the application's icon to your Applications
folder and you're done: the software is now installed and ready to use.
*******************************************************************************
Installation instruction WINDOWS
*******************************************************************************
First, download the .zip archive to your computer from this page. Unpack the
archive file. Now change to the subfolder "fqlite". The application
can be started by calling the batch file run.bat.
*******************************************************************************
Installation instruction LINUX
*******************************************************************************
First, download the tar archive to your computer from this page. Open a command
shell and change to the download folder. Now unpack the tar archive with the
following command:
$ tar zxvf fqlite.tar.gz
Change to the application folder:
$ cd fqlite
Then call the shell script to start FQLite:
$ ./run.sh
### Licence and Author
Author: Dirk Pawlaszczyk <[email protected]>
FQLite for SQLite is licensed under the Apache-License 2.0.
You can modify or redistribute it under the conditions of these licenses.