sqlite-forensic 0.8.1

Forensic anomaly auditor for SQLite databases — header-integrity findings as graded report::Finding, built on sqlite-core (WS-C spike skeleton; WS-E expands carving/WAL/freelist).

sqlite-forensic

Forensic anomaly auditor and deleted-record carver for SQLite databases.

sqlite-forensic builds on sqlite-core to do two things over a read-only database:

Carve deleted records out of free (unallocated) space — freelist pages, in-page free blocks, dropped-table pages, and an uncheckpointed -wal overlay — including lower-confidence partial fragments salvaged where a full row could not be reconstructed.
Audit anomalies, grading forensically-notable header- and structure-level findings into severity-ranked forensicnomicon::report observations.

It opens the evidence file read-only and never writes the file or its sidecars.

Use

use sqlite_core::Database;
use sqlite_forensic::{audit, carve_all_deleted_records};

let db = Database::open(std::fs::read("evidence.db")?)?;
let anomalies = audit(&db);
let recovered = carve_all_deleted_records(&db);