dissect.database.sqlite3.sqlite3

Module Contents

Classes

SQLite3

SQLite3 database class.

Column

Describes a column of a sqlite table.

Table

Index

Row

Empty

Page

Cell

Functions

walk_tree

read_record

varint

Attributes

ENCODING

PAGE_TYPES

SERIAL_TYPES

SQLITE3_HEADER_MAGIC

dissect.database.sqlite3.sqlite3.ENCODING
dissect.database.sqlite3.sqlite3.PAGE_TYPES
dissect.database.sqlite3.sqlite3.SERIAL_TYPES
dissect.database.sqlite3.sqlite3.SQLITE3_HEADER_MAGIC = b'SQLite format 3\x00'
class dissect.database.sqlite3.sqlite3.SQLite3(fh: pathlib.Path | BinaryIO, wal: dissect.database.sqlite3.wal.WAL | pathlib.Path | BinaryIO | None = None, checkpoint: dissect.database.sqlite3.wal.Checkpoint | int | None = None)

SQLite3 database class.

Loads a SQLite3 database from the given file-like object or path. If a path is provided (or can be deduced from the file-like object), a WAL file will be automatically looked for with a few common suffixes. Optionally a WAL file-like object or path can be directly provided to read changes from the WAL (this takes priority over the aforementioned WAL lookup). Additionally, a specific checkpoint from the WAL can be applied.

Parameters:

  • fh – The path or file-like object to open a SQLite3 database on.

  • wal – The path or file-like object to open a SQLite3 WAL file on.

  • checkpoint – The checkpoint to apply from the WAL file. Can be a Checkpoint object or an integer index.

Raises:

InvalidDatabase – If the file-like object does not look like a SQLite3 database based on the header magic.

References

fh
path
wal = None
checkpoint = None
header
encoding
page_size
usable_page_size
page_count
page
__repr__() → str
__enter__() → Self

Return self upon entering the runtime context.

__exit__(_: type[BaseException] | None, __: BaseException | None, ___: types.TracebackType | None) → bool
close() → None

Close the database and WAL.

checkpoints() → collections.abc.Iterator[SQLite3]

Yield instances of the database at all available checkpoints in the WAL file, if applicable.

table(name: str) → Table | None
tables() → collections.abc.Iterator[Table]
index(name: str) → Index | None
indices() → collections.abc.Iterator[Index]
raw_page(num: int) → bytes

Retrieve the raw frame data for the given page number.

Reads the page from a checkpoint, if this class was initialized with a WAL checkpoint.

If a WAL is available, will first check if the WAL contains a more recent version of the page, otherwise it will read the page from the database file.

References

pages() → collections.abc.Iterator[Page]
cells() → collections.abc.Iterator[Cell]
class dissect.database.sqlite3.sqlite3.Column(name: str, description: str)

Describes a column of a sqlite table.

SPACE = '\\s'
EXPRESSION = '\\(.+?\\)'
STRING = '[\'\\"].+?[\'\\"]'
TOKENIZER_EXPRESSION
name
default_value = None
__eq__(other: object) → bool
__repr__() → str
class dissect.database.sqlite3.sqlite3.Table(sqlite: SQLite3, type_: str, name: str, table_name: str, page: int, sql: str)
sqlite
type
name
table_name
page
sql
columns = []
primary_key = None
__repr__() → str
__iter__() → collections.abc.Iterator[Row]
row(idx: int) → Row
rows() → collections.abc.Iterator[Row]
class dissect.database.sqlite3.sqlite3.Index(sqlite: SQLite3, type_: str, name: str, table_name: str, page: int, sql: str)
sqlite
type
name
table_name
page
sql
__repr__() → str
class dissect.database.sqlite3.sqlite3.Row(table: Table, cell: Cell)
__iter__() → collections.abc.Iterator[tuple[str, Any]]
__getitem__(key: str) → Any
__getattr__(key: str) → Any
__repr__() → str
get(key: str, default: Any = None) → Any
class dissect.database.sqlite3.sqlite3.Empty
class dissect.database.sqlite3.sqlite3.Page(sqlite: SQLite3, num: int)
sqlite
num
data
offset
header
right_page = None
cell_pointers
cell
__repr__() → str
open() → io.BytesIO
cells() → collections.abc.Iterator[Cell]
class dissect.database.sqlite3.sqlite3.Cell(page: Page, offset: int)
page
offset
size = None
key = None
left_page = None
max_payload_size
min_payload_size
__repr__() → str
property data: bytes
property types: list[int]
property values: list[int | float | str | bytes | None]
dissect.database.sqlite3.sqlite3.walk_tree(sqlite: SQLite3, page: Page) → collections.abc.Iterator[Cell]
dissect.database.sqlite3.sqlite3.read_record(fh: BinaryIO, encoding: str) → tuple[list[int], list[int | float | str | bytes | None]]
dissect.database.sqlite3.sqlite3.varint(fh: BinaryIO) → int