ZEKASTRA / FORENSIC / BINARY EVIDENCE STRUCTURE
SQLite + WAL: inspect the bytes
A read-only file-format examiner, not another fictional SQL quiz. Inspect the 100-byte SQLite header, validate WAL header/frame checksums, identify commit boundaries and compare committed page images to the main DB.
Original files stay in browser memory and are not uploaded. No SQL engine is started and no input file is altered. Only database structural metadata and page-level differences are analyzed; this page does not decode messages or deleted records.
01 / Load the acquired pair
Begin with an authentic SQLite-generated synthetic fixture
The 1 KiB example main database has one seeded record; two more fictional rows were committed to a 1,104-byte WAL during a live SQLite transaction. The page images are examined without making a checkpoint.
The two download links provide lossless gzip archives. The sample-inspection button decompresses them in memory and calculates SHA-256 over the ORIGINAL decompressed database/WAL bytes.
32 MiB maximum for each file. Main SQLite pages and WAL frames are parsed directly from the supplied bytes. A matching filename/page size does not establish that both files came from the same acquisition.
No files loaded.
02 / Verified source metadata
Original file manifest
SQLite 3 main file header
Schema objects parsed from B-tree page 1 (and committed WAL overlay)
Table/index/view/trigger definitions are read from sqlite_schema record bytes. Only cells contained in one page are decoded; unsupported overflow and malformed records are reported without inventing objects. SQL text is displayed, not executed.
| Type | Name | Table | Root page | Page:cell | Source | Stored CREATE statement |
|---|
Optional active table B-tree preview (read-only)
Choose one decoded rowid table. Up to 200 active cell records are read from the last committed page view. This does not recover deleted messages or interpret application-specific meaning. INTEGER PRIMARY KEY aliases can be null inside the raw payload: the true rowid is displayed separately.
| rowid | Page:cell | Source | Record values (ordered, untyped app meaning) |
|---|
A manually requested preview is included in subsequent JSON export. This may contain sensitive text from the selected file; export only when authorized.
03 / WAL transaction structure
WAL integrity, frames and commit markers
Validated frame prefix (up to 200 displayed)
| # | Page | Commit size, pages | Byte offset | Scope |
|---|
Last committed page images compared with main DB
| Page | Last frame | In main DB | Binary comparison |
|---|
04 / Source-linked output
Export the inspected structure
An explicit JSON manifest contains the parsed header, valid frame prefix and changed-page references. A bilingual technical note separates source facts, interpretation and conclusion. Results are local downloads only.
The evidence workspace package contains source manifests and literal schema/row observations with page locators. Row values may include sensitive text; export only when authorized. No SQL is run or timestamp meaning assigned. Original binary files are not included.
A WAL may be checkpointed or reset; frame presence and byte differences alone do not prove live transaction completeness. No native SQLite integrity_check or SQL row queries are performed.