While manual examination of iOS SQLite database files is possible with the use of free tools, most examiners prefer commercial support prior to digging manually into the files for examination. The following is an example of how to examine a database using SQLite Forensic Browser—a Windows-based tool by Sanderson Forensics, which can be found at http://www.sandersonforensics.com/forum/content.php.
Launch SQLite Forensics Browser and navigate to File | Open SQLite DB:
Opening a database in the Forensic Browser for SQLite
Once the SQLite DB file is opened, the examiner can access the various tables ...
