SQLite is important.
There is zero way to dodge it at this point
in smartphone forensics because most
of the third-party applications and native applications
for Android and iOS rely on SQLite.
Your tools will not be able to parse everything.
New features will be introduced to these apps,
new columns will be introduced, timestamps will be modified.
Things will change that are going
to force you to modify or create new queries to parse
the information.
In this course, you are going to start
with this next lab that is going to force you
to write a query from scratch.
In section 4, this is a perfect example.
We give you a query that worked in iOS 13,
and we say, hey, here is what the database looks
like in iOS 15.
Modify it, and make it work.
So the first thing you have to do is detect the change.
And then you have to fix the change.
It is easier, in my opinion to modify versus
starting from scratch.
So in the notebook that I'm going to provide to you,
if you see something in your database,
and you're, like, I wish Heather would have included that,
include it.
You're going to learn how to modify.
If you create amazing queries and you
think it would be relevant to this class,
please email them to me, so I can add them to our notebook.
The class notebook will always grow.
You have access to it for the rest of your life.
If you take Forensics 500, you're
going to get a glimpse of all the queries I
created for that class as well.
So if you do Windows forensics, cloud
forensics, mobile forensics--
I will say in advance, you're welcome,
because you're getting access to an amazing notebook
full of information.