This course is funded through OJJDP. To
register for this class, you must be affiliated with an ICAC Task Force.
Furthermore, you must agree to comply with the Best Practices and Standards
established by ICAC. If you have any questions about the ICAC Best Practices and
Standards, please contact your ICAC commander.
Course descriptionKey concepts covered in this course include:
Mobile devices dominate the intake list and the
desks of most digital forensics analysts globally. As devices are becoming more
secure, with an increase in security, the need for detailed analysis is
increasing as well. SQLite is a self-contained, serverless database engine. It
is found on nearly every operating system and dominates iOS®, Android®, and macOS as one of the most prevalent and relevant
data storage mechanisms. Rather than hope our forensic tools support the
newest applications or be tethered to how a certain utility parses data, we can
arm ourselves with the skills and techniques needed to conquer the analysis of
nearly any application.
• What is SQLite
and how to identify
and analyze logically
• Recognizing relevant
locations of valuable data within
• Develop skills needed for
crafting custom SQLite
• Recognize and decode a variety of common timestamp formats
• Perform SQLite
analysis with automation
This is an intermediate course,
intended for digital forensic examiners who have a solid understanding of
digital forensic principals, experience preserving and acquiring data of
evidentiary value, and have a minimum of six months of experience performing digital forensic
All classes are subject to cancellation
up to 45 days before the start of class if the minimum class registration
threshold is not met.