Reading encrypted (?) SQLite files from POS

Question

I'm trying to get to the original data stored on a Micros POS. Under the DB folder, I found over a 100 files, arranged in pairs: x.bin, x.key; y.bin, y.key etc. The file names look like table names, and each has a .key and a .bin.

After searching a lot, I got hints and rumors that the DB used by the POS is SQLite and that the files are encrypted, each with it's own key.

My question: is there a programmatic way to get at the data in those .bin files? Bonus: is there a way to create one unencrypted SQLite file containing all tables and all data?

Thanks for your time!

Answer 1

Just staring at the encrypted files will not likely to do much good (unless you have experience with crypto analysis). However, if you have the whole firmware from the device, there's a simpler (IMO) way:

1. Find the code which works with those files (e.g. by searching for .key and .bin in files).
2. Reverse-engineer (disassemble/decompile) it and figure out what it does.
3. Reproduce the decryption step either manually or write a small program to do it.
4. Check if the decrypted data is SQLite format or not.