Oxygen Forensic® Detective offers investigators the ability to start the built-in Oxygen Forensic® SQLite Viewer from the main Home screen or by right-clicking any SQLite database inside the software and choosing “Open in SQLite Viewer”.
In Oxygen Forensic Detective 12.4, we have made the process of working with SQLite databases even more convenient. Now you can open any SQLite database in the newly designed File Viewer by clicking on it. The database will be opened in a separate tab that will be saved between sessions, like all the other program tabs.
Built for today’s massive data sources the new File Viewer opens large SQLite databases several times faster than the standard SQLite Viewer. During testing a 500 Mb database opened in less than 10 seconds.
Let’s have a look at some other features built into the new SQLite Viewer.
- Investigators can open any SQLite database from the program or import any database from a local or network storage. Investigators will notice the database contents are displayed much the same way as before. Tables are located on the left-hand side while the content is in the central grid and the value converter is on the right. If investigators need to view the of SQLite database composition, expand the selected table to see the columns, indexes, triggers, and foreign keys data. This type of table information will help investigators to build complex queries quickly and efficiently.
- If investigators need to convert the values of a column to a readable format, simply right-click the column header, and choose the appropriate format.. The converted value will be saved between sessions.
- The Viewer also allows investigators to create SQL queries. Click on SQL Editor in the left column above the tables, write a search query in the central part of the grid, and press the Execute button. Investigators can always pin the successfully executed query for quick access later. If you save a query to the library, it will be saved and available between sessions.
- If rollback journals and/or write ahead logs are available, they will be automatically opened together with the main SQLite database.
- The new File Viewer allows investigators to see data in linked tables. When an investigators selects an item in the grid, and there are any linked tables, the data will then be shown in the panel below.
- Finally, like the standard SQLite Viewer, our new version allows investigators to move columns by drag-and-drop, rename column headers, and filter data by entering any value in the quick filter.
Please note, currently the File Viewer does not allow the recovery of deleted records and does not have an Export function. These features will be added in the next Viewer version. Stay tuned!