BLOBs can be a pain for you, but they are approachable.
BLOBs are Binary Large OBjects that
are found within databases that contain content,
whether it's a picture, a message, a zip file.
There are all kinds of things that you can get from this.
A student wrote a sqlite_miner parser for us.
So when we look at this-- this is a Perl script.
We type perl, sqlite miner.pl, --file,
and what you want to parse.
I'm going to show you how this works.
And I'm going to risk it on a database
that I don't know if it even has anything in it.
So I'm going to go into Scripts for Class, sqlite_miner,
and I'm going to type cmd.
Now, you have to type perl.
And make sure you spell it correctly, P-E-R-L.
I'm going to start typing sqlite, and just press Tab,
--file.
What do we want to parse?
Now, I'm going to try--
let's try photos.sqlite, and I press Enter.
It tells you, hey, there's absolutely no warranty.
This is open source.
I'm doing this out of the kindness of my heart.
But look at this.
It's telling us that, in the table
ZADDITIONALASSETATTRIBUTES, that there's
a column called ZREVERSELOCATIONDATA,
and there are 8 binary plists hidden in there.
In ZDISTANCEIDENTITY, there are 10 binary plists.
In this table, ZCLOUDMASTERMEDIAMETADATA,
there's a m and it has 11 binary plists.
So you get the point.
It tells you the table, the column,
and you know what's there.
If you want to go-- ooh, sorry, I zoomed out the wrong way.
If you want to go take a look at it,
you can go into sqlite_miner, you'll see output.
It's sorted by dates and times, so I'm
going to look at Photos.sqlite.
You can see Photos.investigated.sqlite.
You also have a results.csv.
You could look at it this way.
But you can go and look at these files.
Let's say you actually wanted to export them.
You can do --export.
If you want to decompress them, you can do --decompress.
Just be careful how far you go.
If you do --decompress, and there
are a whole bunch of GZips or other TAR archives,
it will decompress all of them, and that
could take a period of time.
So I usually recommend doing --export and then looking
for relevance.