sqlite-deleted-records-parser's Introduction

SQLite-Parser

Script to recover deleted entries in an SQLite database and places the output into either a TSV file or text file (-r)

###Usage for sqlparse.py

sqlparse.py -f /home/sanforensics/smsmms.db -o report.tsv
sqlparse.py -f /home/sanforensics/smssms.db -r -o report.txt

Optional switch -p to print out re purposed B-Leaf pages:

sqlparse.py -p -f /home/sanforensics/smsmms.db -o report.tsv
sqlparse.py -p -f /home/sanforensics/smssms.db -r -o report.txt

###Usage for sqlparse_CLI.exe

sqlparse_CLI.exe -f C:\Users\Mari\smsmms.db -o report.tsv
sqlparse_CLI.exe -f C:\Users\Mari\smsmms.db -t -o report.txt

sqlparse_CLI.exe -p -f C:\Users\Mari\smsmms.db -o report.tsv
sqlparse_CLI.exe -p -f C:\Users\Mari\smsmms.db -r -o report.txt

###sqlparse_GUI.exe This file is a GUI interface

###More Information

View the blog post at http://az4n6.blogspot.com/2013/11/python-parser-to-recover-deleted-sqlite.html for more information

Email Mari, arizona4n6 at gmail dot com for help/questions/bugs

sqlite-deleted-records-parser's Issues

UTF-8 Decode & GUI interface crash problem

Hi mdegrazia,

SQLite-Deleted-Records-Parser is a real nice program.
I'm very like it and it solve my meany problem.
But when i use it , i have two trouble:

UTF-8 Decode: ( Using sqlparse_v1.1.py )
Cause I live in Taiwan(Asia) most of need to decode UTF-8 or Big-5. But code default define that
remove some data and this just what I need. Show your codes about this issue as blow.
....
48 parser.add_option("-o", "--output", dest = "outfile", help = "Uutput to a tsv file. Strips white space,
tabs and non-printable characters from data field", metavar = "output.tsv")
....
144 else:
145 #lets clean this up so its mainly the strings - remove white spaces and tabs too
146
147 unallocated = remove_ascii_non_printable(unallocated )
....
176 else:
177 #lets clean this up so its mainly the strings - remove white spaces and tabs too
178 free_block = remove_ascii_non_printable(free_block)
....
When I block these codes, I will decode to UTF-8 preview in the EXCEL document but can't complete
all data open.