Blog

A quick utility for SQLite forensics

When performing forensics on SQLite database files, it’s simple enough to browse through the database directly using a tool like sqlitebrowser, which provides a nice visual interface for exploring the data. However, I’d like to create a tool that goes one step further:   a tool that shows the contents of unallocated or freed blocks within the database, so that it’s possible to see data from rows that once existed, but were later deleted (this can be used, for example, in recovering deleted text messages from an Android device, which usually stores SMS messages in a .sqlite file).

This utility, which I’ll tentatively call SqliteCarve, represents the minimum solution for accomplishing this task: it loads a SQLite file, and parses its pages and B-tree structure. While doing this, it detects the portions of the structure that contain unallocated bytes. It then reads these bytes and parses any strings from them.

The tool presents all the strings found in the unallocated space visually, with a quick way to search for keywords within the strings:

A couple of TODOs for this utility:

  • Support strings encoded with UTF-16 and UTF-16BE, in addition to the default UTF-8.
  • Make better inferences about the type of content present in the unallocated areas, to be able to extract strings more precisely.
Share: TwitterFacebookPin ItWhatsAppLinkedInBuffer

New tool for analysis of Outlook PST files

I’ve been slowly working towards a utility to analyze .PST files from Microsoft Outlook and Exchange, and examine their contents. A .PST file is the database in which Outlook stores your email locally on your PC. When recovering data from your own PC, or when performing forensic analysis of another PC, it’s often useful to view the contents of .PST files, thereby viewing sent, received, and deleted emails.

OutlookMailViewer  (download it!) allows you to open a .PST file (without requiring Outlook to be installed) and examine its contents in an intuitive way, very similarly to the way Outlook itself displays your email. This tool is entirely read-only, meaning that you can be sure that the .PST file won’t be modified in any way.

This software is very much experimental/alpha, and needs a bit more work to be as powerful as possible, but it can still be quite useful as it is:

  • Supports .PST files from nearly all previous versions of Outlook, as well as the latest Outlook 2016 (supports ANSI and Unicode .PST files).
  • Displays plain-text, HTML, and RTF versions of email messages.
  • Displays absolutely all properties associated with each email message (more properties than Outlook itself shows).
  • Allows saving of attachments from messages.

Some to-do items for a future version:

  • Scan the .PST file for orphan messages (i.e. messages that still exist after being emptied from Deleted Items, but before the database is compacted).
  • Filtering and searching of messages.
  • Exporting messages in different formats.

Try it out! If you’re using the current Outlook 2016, you can usually find your .PST file in [My Documents]\Outlook Files\[your account].pst.

Share: TwitterFacebookPin ItWhatsAppLinkedInBuffer

A simple 3D model viewer for your Android device

I’m happy to release a simple little app for Android devices for viewing 3D model files, particularly STL models (widely used in 3D printing), and limited support for OBJ and PLY models. Find it on the Google Play Store now!

You can open model files from within the app, and the app also registers itself as a handler for opening .STL files, so that it will be launched automatically when you select an STL file from another app, such as your browser or file manager.

Best of all, the app has a VR button that will instantly switch to VR mode, allowing you to place your device into your VR headset, so you can view the model in true 3D.   It supports motion tracking, allowing you to examine the model from all angles by moving your head.

I  actually developed the app during the 2017 Wikimedia Hackathon in Vienna, but I’ve only recently gotten around to cleaning it up and releasing it. Enjoy, and browse the source code if you like.

Share: TwitterFacebookPin ItWhatsAppLinkedInBuffer

MushroomHuntr

I’m a bit late to the party in starting to tinker with TensorFlow, but nevertheless I’ve been having some product ideas (some dumber than others) for real-world applications of machine learning, and here’s one of the stupider ones:

If you know me at all, you know that one of my hobbies is foraging for wild mushrooms. Going to the forest to forage for mushrooms is a time-honored tradition in Russia and many other Slavic countries.  I also derive great pleasure from sharing this hobby with other people, and telling them how fun, challenging, and rewarding this activity can be.

Therefore, I give you –  MushroomHuntr: an Android app that can identify different varieties of mushrooms!  It uses a neural network to perform image recognition in real time, to tell you what kind of mushroom you’re looking at.

Huge legal disclaimer: Do not actually rely on this app to differentiate poisonous mushrooms from edible ones!  The app provides a rough guess of the identity of a mushroom, not a definitive identification.

Under the hood, the app uses the Inception v3 model developed by Google, with the top layer of the model re-trained on a large collection of mushroom images. Many of the training images were taken from Wikimedia Commons, and others came from my personal photos that I’ve taken over the years.

The app can distinguish between about twelve varieties of mushrooms, most of which are native to North America and Europe. All of the trained varieties are common enough to be found easily in parks and forests, to maximize the app’s usefulness for the novice mushroom hunter.

When the app is launched, it automatically enables your phone’s camera, and starts attempting to recognize anything it sees in the image.  Therefore, all you need to do is aim the camera at a mushroom, and see what it says!

To maximize the accuracy of the mushroom recognition, try looking at the mushroom from the side, and bring the camera close enough for the mushroom to fill up most of the frame, like this:

I won’t make this app available on the Google Play Store for the time being, while I continue to refine the model, but if you’d like to check it out, you can build it from source code, or contact me for a pre-built APK that you can install on your device.

Share: TwitterFacebookPin ItWhatsAppLinkedInBuffer