SQLite 数据库取证解析

---
name: sqlecmd
version: 1.0.0
description: Parse and extract data from SQLite databases using Eric Zimmerman's SQLECmd. Covers CLI flags, map-driven extraction, output formats (CSV/JSON), blob export, and map structure reference.
metadata:
  tool-name: SQLECmd
  tool-vendor: Eric Zimmerman
---

# SQLECmd Skill

SQLECmd is Eric Zimmerman's command-line tool for parsing SQLite database files using map definitions. It identifies SQLite databases by file header, matches them to maps that define SQL queries and column mappings, and outputs structured CSV or JSON. Any SQLite database can be parsed as long as a map (.smap) exists for its schema. Forensic interpretation of SQLite data (browser history analysis, application activity reconstruction, etc.) belongs in a separate analysis skill.

## Command Syntax

```
SQLECmd.exe -f <file> --csv <dir> [other options]
SQLECmd.exe -d <directory> --csv <dir> [other options]
```

Single-letter options use a single dash (`-`). Multi-character options use double dashes (`--`).

## Input (one required)

| Flag | Description |
|------|-------------|
| `-f` | Single SQLite file to process |
| `-d` | Directory to process containing SQLite files |

## Output Formats

| Flag | Description |
|------|-------------|
| `--csv` | Directory to write CSV output |
| `--json` | Directory to write JSON output |

It's recommended to specify at least one output format to write results to a file. Forensic output can be very large and may consume the context window. CSV is the most common choice for analysis with Timeline Explorer or Excel.

## Options

| Flag | Description | Default |
|------|-------------|---------|
| `--hunt` | Examine all files regardless of name; identify SQLite files by header | FALSE |
| `--maps` | Path to map (.smap) files | `Maps` folder next to the executable |
| `--sync` | Download latest maps from GitHub before processing. Requires network access. | FALSE |
| `--dedupe` | Deduplicate files via SHA-1 | TRUE |
| `--blobdir` | Directory to save extracted blob data to | |
| `--noblob` | Disable blob extraction from query results | FALSE |
| `--debug` | Show debug information | FALSE |
| `--trace` | Show trace information | FALSE |

## Output Structure

SQLECmd produces one CSV file per map query that matches the input. Output filenames follow the pattern `<CSVPrefix>_<BaseFileName>.csv` as defined in each map.

Every output file includes a **SourceFile** column appended to the query results, identifying which SQLite database the row came from.

CSV column names are defined by each map's SQL query aliases, not by the tool itself. Different databases produce different columns depending on their map definitions.

## Maps

Maps (.smap files) are YAML definitions that tell SQLECmd how to identify and extract data from specific SQLite databases. Each map defines:

| Field | Description |
|-------|-------------|
| **Description** | Human-readable description of the database |
| **CSVPrefix** | Prefix for output CSV filenames |
| **FileName** | Expected database filename (used for matching) |
| **IdentifyQuery** | SQL query to confirm database identity |
| **IdentifyValue** | Expected result of the identify query |
| **Queries** | Array of SQL queries with column aliases defining CSV output |

Maps are stored in the `Maps` directory (default: next to the executable). The `--hunt` flag bypasses filename matching and identifies SQLite files by their file header, allowing maps to match databases with renamed or unexpected filenames.

Common map categories include browsers (Chrome, Firefox, Edge), messaging apps, Windows artifacts (Notifications, Activities/Timeline), and mobile databases.

## Workflow Examples

### Parse a single SQLite database to CSV

```
SQLECmd.exe -f "C:\Cases\Evidence\History" --csv "C:\Cases\Output"
```

### Parse a directory of SQLite databases

```
SQLECmd.exe -d "C:\Cases\Evidence\AppData" --csv "C:\Cases\Output"
```

### Hunt for all SQLite files in a directory

```
SQLECmd.exe -d "C:\Cases\Evidence" --csv "C:\Cases\Output" --hunt
```

### Parse with blob extraction to a directory

```
SQLECmd.exe -d "C:\Cases\Evidence\AppData" --csv "C:\Cases\Output" --blobdir "C:\Cases\Output\Blobs"
```

### Parse without blob extraction

```
SQLECmd.exe -d "C:\Cases\Evidence\AppData" --csv "C:\Cases\Output" --noblob
```

### Parse from a mounted forensic image

```
SQLECmd.exe -d "E:\Users" --csv "C:\Cases\Output" --hunt
```