So let's look at some of the basics here.
With these databases, SQLite format 3
is the most common that's still in use.
You can see SQLite format 3 file header here.
These file headers are important because, when
we talk about evidence destruction,
and we need to carve for items, we
may need to carve for that file header.
So any that you know of, you can always Google these.
You want to make sure you're documenting them.
There are other databases in use that you're going to see.
When we look at databases in general,
these are relational databases that
are used to store/modify access data.
They are efficient.
They can grow in size.
They are open source.
You will see a vast amount of sizes and things
that differ depending on the artifact of interest.
You could have some enormous databases.
A good example is my Photos.sqlite database.
I use my iPhone as my camera.
My Photos.sqlite database is enormous.
It's not something I probably want to use for testing.
I have another iPhone that I still take pictures on
that I leverage that.
So if you have a person and their photos,
that SQLite database on their iPhone is small,
and you're seeing a lot of pictures,
that doesn't make sense.
So sometimes the size of the database
can be a great example on what you could find.