Search Sqlite Database - All Tables and Columns

Question

Is there a library or open source utility available to search all the tables and columns of an Sqlite database? The only input would be the name of the sqlite DB file.

I am trying to write a forensics tool and want to search sqlite files for a specific string.

Answer 1

I know this is late to the party, but I had a similar issue but since it was inside of a docker image I had no access to python, so I solved it like so:

for X in $(sqlite3 database.db .tables) ; do sqlite3 database.db "SELECT * FROM $X;" | grep >/dev/null 'STRING I WANT' && echo $X; done

This will iterate through all tables in a database file and perform a select all operation which I then grep for the string. If it finds the string, it prints the table, and from there I can simply use sqlite3 to find out how it was used.

Figured it might be helpful to other who cannot use python.

Answer 2

Just dump the db and search it.

% sqlite3 file_name .dump | grep 'my_search_string'

You could instead pipe through less, and then use / to search:

% sqlite3 file_name .dump | less