AADF · SQLite and database forensics training
Deep-dive database forensics: SQLite internals and deleted-record recovery (freeblocks, freelists, WAL and journals), SQL querying, Chromium SNSS, LevelDB, Realm and binary plists across Windows, Mac, Android and iOS.
Delve into the intricate world of database forensics across multiple platforms with our comprehensive course. Learn to harness various applications and utilities to adeptly identify, process, understand, and exploit diverse database structures.
Gain invaluable insights into the functioning of databases, unravelling the intricate storage of records and fields of information essential for supporting front-end applications. Delve deep into SQLite, mastering techniques to recover deleted information from Freeblocks, Free Pages and page unallocated space within primary and journal files using sophisticated scripting techniques.
Explore a myriad of additional databases including SNSS Files, LevelDBs, Realm databases and Binary Plists, equipping yourself with a versatile skill set crucial for forensic investigations across various platforms. Throughout the course, students will examine data that can be found on a range of systems including Mac, Windows, Android, and iOS, providing a holistic understanding of database forensics across diverse environments. Hands-on labs and student exercises provide practical application of acquired knowledge, utilizing a blend of open-source and leading forensic applications. By engaging in multiple hands-on activities, participants refine their skills, gaining proficiency in examining key artifacts crucial for successful forensic investigations.
By the end of the course, participants will be equipped with advanced database forensics skills, ready to extract active and deleted data from databases across a wide range of systems with confidence and precision.
Examiners with intermediate or advanced forensic training who want to go beyond tool extractions and recover active and deleted data from databases.
To get the most out of this class, you should:
You will receive a student manual, lab exercises and other class-related material.
The course will adhere to adult learning principles, employing training aids such as presentations, diagrams, and practical instructor-led examples. Each covered artifact will be presented in either one or two 50-minute sessions, followed by review questions. Students will have opportunities throughout the course to ask questions and delve into covered objectives in greater detail. Practical exercises will be assigned each day to reinforce the topics.
Every participant who passes the course receives an official e-DiFTA certificate confirming successful completion of the class and recognising the training hours completed.
Senior Trainer / Developer – Director of Professional Services, Spyder Forensics
Damien Attoe is a digital forensics educator, course developer and practitioner with more than a decade of experience in digital forensics and eDiscovery. As a member of Spyder Forensics, he specialises in transforming complex forensic concepts into…
You should know the basics of digital forensic examinations, understand data structures beyond simple tool extractions, and have attended Spyder Forensics Intermediate or Advanced training (or a similar programme) in the last 18 months.
Attendance is intended exclusively for law enforcement personnel, military personnel engaged in digital forensic activities and private-sector investigators.
Five days of hands-on training (08:00–17:00), an official certificate of successful completion recognising the training hours, a buffet lunch and morning and afternoon coffee breaks every day.
Seats are limited and allocated on a “first paid – first confirmed” basis. Your registration is confirmed once payment is received; the payment deadline is 25 December 2026.
Yes. Every participant who passes the course receives an official e-DiFTA certificate confirming successful completion of the class and recognising the training hours completed.
Invoices are issued from France. Private individuals and organisations in France pay French VAT (20%). Organisations outside France are invoiced without French VAT when they provide a valid VAT number, TIN or EIN. Full VAT rules.
Expert-level Windows 11 forensics over five days: BitLocker, WSL and Sandbox, Registry and user activity, Helium apps, OneDrive, Chromium browsers and SQLite exploitation.
A 36-hour advanced course on extracting and analysing data from drones (UAS), their controllers and mobile apps – DJI, ArduPilot, PX4 and FPV – using non-destructive, court-ready workflows.
Investigate network intrusions and ransomware using host-based evidence: traffic artefacts, live triage, memory analysis, Windows event logs and Registry persistence, and attack timelines.
Learn to use AI and large language models as investigative tools – and to recognise how criminals misuse them – with hands-on work on LLMs, RAG systems, AI agents and the EU AI Act.
