Lecture 10: Analysing Unknown Databases

Question 1

What to do?

Answer 1

• Understand / Use the Application
• Find the SQLite files
• Gather information on each database file
• Perform common application tasks
• Develop SQL queries to extract information

Question 2

1 Understand / Use the Application

Answer 2

• What can the application do?
• What information might be stored in SQLite logs?
• What is already known about the application?

Question 3

2 Find SQLite files used by the application

Answer 3

–Google
–Profiles / Preferences
–Install application in a Virtual Machine

Question 4

3 Gather information on each
database file

Answer 4

• List all tables
• Describe the structure of each
• Record number of entries in each table
• Attempt to identify links between tables

–> understand the structure

Question 5

4 Perform common tasks

Answer 5

Rerun step 3 (Gather information on each
database file)

Question 6

5 Develop SQL queries to extract information

Answer 6

• Create SQL queries to extract the required information
• Record the queries