SQLite Data

A forensic tool provides SQLite functionality.

MDT-RO-11. A mobile device forensic tool shall report the data content of all rows for each active table in the database.

MDT-AO-21. The tool shall display numeric values (e.g., integer and floating-point values).

MDT-AO-22. The tool shall display integer time values as a conventional human-readable
date and time.

MDT-AO-23. The tool shall render text for Text fields, table names, and column names encoded in Unicode Transformation Format (UTF) 8, UTF 16BE, and UTF 16LE.

MDT-AO-24. The tool shall decode and display base64 encoded text.

MDT-AO-25. The tool shall display graphic image data recorded as a BLOB in the
database.

MDT-AO-26. The tool shall decode data recorded as a BLOB in the database.

MDT-AO-27. The tool shall have the ability to display SQLite BLOB data (e.g., graphic
files and plist).

MDT-AO-28. The tool shall report all currently active data when WAL mode is in use.

MDT-AO-29. The tool shall report all currently active data when journal mode is in use.

MDT-RO-12. A mobile device forensic tool provides embedded SQLite functionality.

MDT-AO-30. The tool shall execute SQLite commands and report the results.

MDT-AO-31. The tool shall have the ability to save SQLite commands for later recall.