Difference between revisions of "Identifying Databases"
| Line 10: | Line 10: | ||
This is the traditional method of analyzing the content of the file to identify the program that created it. | This is the traditional method of analyzing the content of the file to identify the program that created it. | ||
This uses whatever technique is necessary, [https://en.wikipedia.org/wiki/Magic_number_(programming) file signature] or recognizing data structures, to determine the type. | This uses whatever technique is necessary, [https://en.wikipedia.org/wiki/Magic_number_(programming) file signature] or recognizing data structures, to determine the type. | ||
| + | |||
| + | This is good enough to tell you that a bag of bytes is a [[Type_SQLite_Database|SQLite]] file but it won't tell you that it is a [[Type_GMail_Mailstore_Database|GMail mailstore]]. | ||
=Extract Schema= | =Extract Schema= | ||
The [https://en.wikipedia.org/wiki/Database_schema schema] | The [https://en.wikipedia.org/wiki/Database_schema schema] | ||
Revision as of 06:19, 28 June 2021
This article describes how Truxton determines the type of a database file.
Introduction
Databases present a unique problem for Truxton. While it is easy to determine the basic type of the file, SQLite or ESE, determining the type of database for exploitation purposes is problematic. In order to know how to exploit a database file you must first exploit the database file.
Initial Identification
The first step in database identification is identifying the data file. This is the traditional method of analyzing the content of the file to identify the program that created it. This uses whatever technique is necessary, file signature or recognizing data structures, to determine the type.
This is good enough to tell you that a bag of bytes is a SQLite file but it won't tell you that it is a GMail mailstore.
Extract Schema
The schema
