Carve SQLite databases and parse plist artifacts from mobile backups.
npx skills add https://github.com/droxey/skills --skill mobile-forensics-droxey
Please help me install this Agent Skill. Skill: mobile-forensics Source: https://github.com/droxey/skills/tree/main/mobile-forensics Command: npx skills add https://github.com/droxey/skills --skill mobile-forensics-droxey
Mobile backups and app exports are hard to interpret, so you need a repeatable way to recover data, parse key artifacts like SQLite and plists, and produce a defensible forensic report.
Use the mobile-forensics skill to extract recoverable evidence from an iOS or Android backup by focusing on SQLite databases, parsing relevant plists, and generating a structured forensic report outline.
High-intent search queries and answers about installing and using this skill.
To extract chat app data from a mobile backup, you target SQLite databases and parse relevant plists for apps like Signal, WhatsApp, Telegram, iMessage, and Messenger. This involves carving cached data and interpreting schemas to build defensible timelines and findings.
Recovering deleted messages from corrupted SQLite databases requires SQLite and WAL carving techniques to extract residual content. By interpreting chat-related schemas and timestamps, you can recover artifacts from corrupted databases and WAL files within mobile backups.
Plist parsing decodes binary and XML property lists to identify mobile backup state and manifest details. By analyzing app-group data and preferences, plist parsing reveals critical metadata and configuration artifacts necessary for comprehensive forensic reporting.
Yes, you can generate a defensible forensic report by organizing methodology, findings, and an artifact index from extracted mobile data. This structure preserves the extraction techniques used for SQLite and plist artifacts, making the report suitable for investigation documentation.
SQLite recovery on mobile backups requires artifact-focused extraction techniques and knowledge of database schemas. You need to apply WAL recovery approaches to interpret content, extract timestamps, and assemble findings into a structured forensic report.
Yes, mobile forensic recovery applies to both iOS and Android backup scenarios. The extraction workflows target common artifacts across major chat apps and parse SQLite databases and plists regardless of the mobile operating system backup format.
doghelWangDetect and parse JSON, XML, Protobuf, SQLite, and raw binary files.
ArianHobson333Generate final engagement reports from parsed findings and Markdown templates.
ZurybrRecover data from corrupted or encrypted SQLite WAL files.
ZurybrRecover data from truncated SQLite databases via binary page analysis.
