Identifying Databases

This article describes how Truxton determines the type of a database file.

Introduction

Databases present a unique problem for Truxton. While it is easy to determine the basic type of the file, SQLite or ESE, determining the type of database for exploitation purposes is problematic. In order to know how to exploit a database file you must first exploit the database file.

Initial Identification

The first step in database identification is identifying the data file. This is the traditional method of analyzing the content of the file to identify the program that created it. This uses whatever technique is necessary, file signature or recognizing data structures, to determine the type.

Extract Schema

The schema