Hands-on, on-demand training for digital forensic practitioners. Examine real SQLite databases, WAL files, and encoded payloads, work at the byte level, and prove your findings in practical challenges.
Start with the device. Follow what remains.
Illustrative deletion and recovery: the message “Meet behind the station.” disappears from the conversation and ordinary SQL queries. Its 24 UTF-8 bytes survive in messages.sqlite, page 2, in a 55-byte freeblock at file offset 0x00001F94. The message begins at 0x00001F9F. Schema-assisted recovery yields text fields, but the original row ID and parts of the record header have been overwritten. This demonstration uses a purpose-built teaching database, not Apple's Messages schema. Recovery depends on the bytes that remain.
Most on-demand forensics training is video plus a multiple-choice quiz. This is not that.
Examine complete SQLite databases, WAL files, and encoded payloads, not screenshots or canned walkthroughs.
Use browser-based hex viewers, varint decoders, and freelist walkers. Start immediately; install nothing.
Finish each lesson with a CTF-style challenge that tests what you just learned.
Complete each task using Firefly or freely available tools. Learn a repeatable forensic method, not a vendor workflow.
Go from recognizing SQLite file structures to recovering deleted records from freelist pages in 24 hours of self-paced, hands-on training.