Homec4science
Diffusion sqlcipher_carve_dataset (main)

Edit
sqlcipher_carve_dataset
ActivePublic

Branch: main
Actions
Clone

Repository containing a dataset to test sqlcipher database processing, recovering deleted and visible messages.

sqlcipher_carve_dataset (main)

README.md
dataset1/
dataset2/
dataset3/

Recent Commits

CommitAuthorDetailsCommitted
502f9b7e65e8regnery
format keystore data as code 
Feb 6 2023
1b82fbcbc77fregnery
initial commit 
Feb 6 2023

README.md

SQLCipher forensic datasets

Dataset 1

Signal application 6.6.0.14 on iOS 15.6.1 Two files:

  • signal.sqlite (sha1: 1f3bd6bbc8b36a54a00d3fd86307ce69c1bf6e61)
  • signal.sqlite-wal (sha1:82bca3cf580fdbdc723385129a0166dbaa5fb9eb)

Keychain data:

<dict>
	<key>SecAccessControl</key>
	<data>
	MQ0wCwwEcHJvdAwDY2t1
	</data>
	<key>TamperCheck</key>
	<data>
	OTFFMEVDNDUtODAyOS00NTU3LUE0OUEtMkZCNTA2QTgyNjM1
	</data>
	<key>UUID</key>
	<data>
	NzQ1MkMxMjAtRTg4Mi00RUFCLUEzQjQtNDk3MTI5NzNCREZE
	</data>
	<key>acct</key>
	<data>
	R1JEQkRhdGFiYXNlQ2lwaGVyS2V5U3BlYw==
	</data>
	<key>agrp</key>
	<data>
	VTY4TVNETjZEUi5vcmcud2hpc3BlcnN5c3RlbXMuc2lnbmFs
	</data>
	<key>cdat</key>
	<data>
	MjAyMTA5MTcxMzMyNTUuMTk4NjA5Wg==
	</data>
	<key>clas</key>
	<integer>10</integer>
	<key>mdat</key>
	<data>
	MjAyMTA5MTcxMzMyNTUuMTk4NjA5Wg==
	</data>
	<key>musr</key>
	<data>
	</data>
	<key>pdmn</key>
	<data>
	Y2t1
	</data>
	<key>persistref</key>
	<data>
	Ix+EtwAgSuuK3++Ar8fiqw==
	</data>
	<key>rowid</key>
	<integer>322</integer>
	<key>sha1</key>
	<data>
	nrK86YJoXxtDA3zvrR0ZRL1Ja4o=
	</data>
	<key>svce</key>
	<data>
	R1JEQktleUNoYWluU2VydmljZQ==
	</data>
	<key>sync</key>
	<data>
	MA==
	</data>
	<key>tomb</key>
	<data>
	MA==
	</data>
	<key>v_Data</key>
	<data>
	FRmVWPo3xEdJzF9rXoWVxTjRCTnZFwYN5SftfOjob0nw35pGuSmw
	lnC/ZZM+Erfe
	</data>
</dict>

Dataset 2

Signal application 6.6.0.14 on iOS 15.6.1 Two files:

  • signal.sqlite (sha1: 53fa87d0ad4eb8452274b0628be7b001c5a3e3e8)
  • signal.sqlite-wal (sha1:2dac01357b3f03fe784ff3a7dea21bd5d77a980c)

Keychain data:

<dict>
	<key>SecAccessControl</key>
	<data>
	MQ0wCwwEcHJvdAwDY2t1
	</data>
	<key>TamperCheck</key>
	<data>
	OTFFMEVDNDUtODAyOS00NTU3LUE0OUEtMkZCNTA2QTgyNjM1
	</data>
	<key>UUID</key>
	<data>
	NzQ1MkMxMjAtRTg4Mi00RUFCLUEzQjQtNDk3MTI5NzNCREZE
	</data>
	<key>acct</key>
	<data>
	R1JEQkRhdGFiYXNlQ2lwaGVyS2V5U3BlYw==
	</data>
	<key>agrp</key>
	<data>
	VTY4TVNETjZEUi5vcmcud2hpc3BlcnN5c3RlbXMuc2lnbmFs
	</data>
	<key>cdat</key>
	<data>
	MjAyMTA5MTcxMzMyNTUuMTk4NjA5Wg==
	</data>
	<key>clas</key>
	<integer>10</integer>
	<key>mdat</key>
	<data>
	MjAyMTA5MTcxMzMyNTUuMTk4NjA5Wg==
	</data>
	<key>musr</key>
	<data>
	</data>
	<key>pdmn</key>
	<data>
	Y2t1
	</data>
	<key>persistref</key>
	<data>
	Ix+EtwAgSuuK3++Ar8fiqw==
	</data>
	<key>rowid</key>
	<integer>322</integer>
	<key>sha1</key>
	<data>
	nrK86YJoXxtDA3zvrR0ZRL1Ja4o=
	</data>
	<key>svce</key>
	<data>
	R1JEQktleUNoYWluU2VydmljZQ==
	</data>
	<key>sync</key>
	<data>
	MA==
	</data>
	<key>tomb</key>
	<data>
	MA==
	</data>
	<key>v_Data</key>
	<data>
	FRmVWPo3xEdJzF9rXoWVxTjRCTnZFwYN5SftfOjob0nw35pGuSmw
	lnC/ZZM+Erfe
	</data>
</dict>
  1. Dataset 3

Signal application 5.51.7 on Android 11 Two files:

  • signal.db (sha1: 73285c288a2d87b6266f669bd531bae4c7dcec5b)
  • signal.db-wal (sha1:3e80898595ecaf0023cb618b11fa25da559d2add)

    Keystore data : ` "org.thoughtcrime.securesms": [ { "result_type": 1, "description": "pref_database_encrypted_secret", "encrypted_data": "11fa79235a154a23a616511096ad39a415adabacccc80dd916c90cd9f9f2b19657227de684759027be23b57d10b4c579", "decrypted_data": "c06927f4386757ab0ec0bc7c80bca674ab027309e517976de79cd35b5518b5ed" }, ]
c4science · Help