Module sqlite 

Read-only, WAL-safe opening of browser SQLite evidence databases.

Browser evidence DBs (History, Cookies, places.sqlite, …) must never be mutated. A naive read-write rusqlite::Connection::open can checkpoint an attached -wal on close, rewriting the main file — the cardinal sin for a forensic tool. open_evidence_db is the single, secure-by-default way the workspace opens such a file.

WAL correctness

SQLite’s immutable=1 URI flag makes a read-only open ignore the -wal, silently dropping the newest uncheckpointed rows. We therefore use immutable=1 only when there is no -wal. When a non-empty {path}-wal sidecar exists, we copy the {db, -wal, -shm} working set into a disposable temp directory and open the copy READ_ONLY — the WAL is honored, and any checkpoint that SQLite chooses to perform lands on the throw-away copy, never the evidence.

Structs

EvidenceDb

A read-only evidence SQLite connection plus its access provenance.

EvidenceProvenance

Provenance for an opened evidence database.

Functions

open_evidence_db

Open a browser SQLite evidence database read-only and WAL-safe.