SQLite Visualizer

SQLite Visualizer is an all-in-one forensic analysis platform designed for investigators, digital forensic examiners, incident responders and analysts working with SQLite databases. The platform combines database exploration, deleted record recovery, WAL analysis, low level page inspection, decoding, reporting, and evidence validation into a single workflow. It is designed to help investigators recover, analyze, and validate evidence stored within application databases.

Key Features

Visual Database Analysis

  • Interactive visual canvas showing tables, relationships, schemas and record counts
  • Instant understanding of application data structures
  • Visual relationship mapping for complex databases
  • Custom virtual views for streamlined investigations

Advanced SQLite Forensics

  • WAL (Write-Ahead Log) reconstruction and analysis
  • Timeline based WAL review
  • Deleted record recovery
  • Freelist page recovery
  • Freeblock carving and artifact extraction
  • Rollback journal analysis
  • Pending deletion detection before checkpoint removal

Page-Level Validation

  • B-Tree visualization
  • Page level inspection
  • SQLite specific hex analysis
  • Varint decoding
  • Overflow chain navigation
  • Source attribution and forensic validation tools

Built-In Data Decoding

Supports direct decoding of:

  • Property Lists (Plists)
  • Protocol Buffers (Protobufs)
  • Base64
  • GZIP
  • JSON
  • Markdown
  • GPS and location data
  • Timestamps

All decoding occurs inside the platform without exporting data to external tools.

SQL Analysis Environment

  • Integrated SQL query editor
  • Visual JOIN builder
  • Query library and reusable views
  • Context aware query creation
  • Structured workflow for large datasets

Geospatial Route Playback

Version 1.2 introduces:

  • Interactive map visualization
  • Latitude and longitude plotting
  • Route reconstruction
  • Movement playback from SQLite records
  • Saved route views for investigations

Professional Reporting

  • Interactive HTML reports
  • Evidence summaries
  • Table exports
  • Hash information inclusion
  • Case metadata integration
  • Secure ZIP packaging
  • Customizable report templates

Forensic Integrity & Case Management

  • Read-only analysis mode
  • Protected evidence copies
  • Multi-algorithm hash verification
  • Case metadata management
  • Analysis history preservation
  • Repeatable forensic workflows

Built-In Forensic Assistant

  • AI-powered forensic chatbot
  • SQL assistance
  • SQLite structure explanations
  • Multi-language support
  • Operates without accessing evidence data directly

Advanced Edition Features

LevelDB Viewer

  • LevelDB analysis
  • Chromium browser artifacts
  • Electron application data
  • Cloud-synced application data
  • Key-value store inspection
  • Overwritten artifact analysis

Cross-Storage Correlation

  • Correlate SQLite and LevelDB evidence
  • Browser cache analysis
  • Application synchronization tracking
  • Multi-storage forensic investigations

Ideal Use Cases

  • Mobile device forensics
  • iOS application investigations
  • Android application investigations
  • Digital forensic examinations
  • Incident response investigations
  • Evidence validation
  • Deleted data recovery
  • Browser artifact analysis
  • Cloud application investigations
  • Court-ready forensic reporting

H-11 Digital Forensics

8160 South Highland Drive, Suite 207
Sandy, UT 84093

Phone: +1.801.596.2727

Contact Us