What problem does it solve?
Provides a systematic, forensic workflow to recover actual data from SQLite Write-Ahead Log (WAL) files that are corrupted, encrypted, or inaccessible through normal filesystem access, ensuring recovered results are verified rather than guessed.
Core Features & Use Cases
- Environment discovery: Inventory files with multiple methods, compare tool vs bash outputs, and search for encryption keys or configuration clues.
- File analysis: Inspect WAL headers and binary frames, detect corruption or high-entropy encryption, and locate page/frame boundaries for extraction.
- Recovery approaches: Search for decryption keys, test SQLCipher/SEE and common encryption formats, run sqlite3 recovery commands and manual page reconstruction, and extract partial data using strings and pattern parsing.
- Verification & escalation: Validate recovered data against schema and integrity checks, cross-reference main database entries, and follow an escalation checklist before declaring failure.
Quick Start
Use the db-wal-recovery skill to analyze the provided WAL file for headers, detect encryption or corruption, and attempt safe extraction and verification of readable pages.
