forensic

sqlite-forensic

Forensic anomaly auditor and deleted-record carver for SQLite databases.

sqlite-forensic builds on sqlite-core to do two things over a read-only database:

• Carve deleted records out of free (unallocated) space — freelist pages, in-page free blocks, dropped-table pages, and an uncheckpointed -wal overlay — including lower-confidence partial fragments salvaged where a full row could not be reconstructed.
• Audit anomalies, grading forensically-notable header- and structure-level findings into severity-ranked forensicnomicon::report observations.

It opens the evidence file read-only and never writes the file or its sidecars.

Use

use sqlite_core::Database;
use sqlite_forensic::{audit, carve_all_deleted_records};

let db = Database::open(std::fs::read("evidence.db")?)?;
let anomalies = audit(&db);
let recovered = carve_all_deleted_records(&db);

Privacy Policy · Terms of Service · © 2026 Security Ronin Ltd