DB Browser for SQLite (DB4S)
sqlitebrowser project · 3.13 · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
An open-source cross-platform GUI for creating, browsing, querying, and editing SQLite and SQLCipher databases, with a spreadsheet-like table view and a full SQL editor. Point releases are infrequent but the repository remains active and nightly builds are published.
Who it is for, and when
Nearly every artefact of modern mobile and browser forensics is a SQLite database, and DB4S is how most examiners actually look inside one — inspecting the schema, running a join across message and contact tables, and confirming that a tool's parsed output matches the underlying rows. That verification role is its real value in expert work: being able to show the query and the raw rows behind a conclusion is far stronger than citing a suite's report. SQLCipher support covers the encrypted databases some applications use.
What it does not cover
It is a database editor, not a forensic tool, and it will happily write to evidence — always work on a copy, and be aware it does not handle write-ahead log and journal files the way a forensic SQLite parser does, so records still sitting in a -wal file or in freelist pages can be invisible or misleading. It does not recover deleted rows, carve database fragments, or maintain any audit trail of what you did.
Go to the source
Open at sqlitebrowser.org (opens in a new tab)https://sqlitebrowser.org/
Details
- Type
- Tool
- Written for
- New to the fieldWorking examinerNew to the field, Working examiner
- Publisher
- sqlitebrowser project
- Version verified
- 3.13
- Year
- 2026
- Topics
- sqlite, mobile, browser-forensics, open-source, validation
- Checked at source
Related entries
A family of open-source Python parsers for mobile and returns data: iLEAPP for iOS logs, events and plists, ALEAPP for Android, and RLEAPP for returns and records from cloud and carrier providers. All three are released very frequently and are among the most actively maintained tools in mobile forensics.
Alexis Brignoni's blog on mobile forensics and open-source tooling, closely tied to the xLEAPP family of parsers — iLEAPP, ALEAPP, RLEAPP and VLEAPP — which he maintains with others.
A maintained index of populated mobile test images produced by Joshua Hickman and linked from his blog: Android 7 through 14, and iOS 13, 14 (with a macOS Big Sur image), 15, 16 and 17. Most are hosted by Digital Corpora, with one iOS 14 set on MediaFire.
An open-access reference to the structures underneath mobile evidence, in two parts: mobile file systems (APFS, Ext4, F2FS, QNX6) and the serialisation formats that carry app data (SQLite, property lists, Java serialization, Realm, protocol buffers), each chapter written by a specialist and each noting the forensic value of the structure.
A device-by-device walkthrough of mobile acquisition and analysis: iOS and Android internals and file systems, logical and physical extraction, app and SQLite artifacts, cloud extraction, mobile malware and reporting.