Windows Media Player Database CurrentDatabase_372.wmdb files

This article covers the program Microsoft Windows Media Player and analysis of the data file typically titled CurrentDatabase_372.wmdb and how to extract the content for review. This article may serve as an aid to forensic examiners or data recovery technicians.

WMDB Extractor for CurrentDatabase_372.wmdb:
http://www.simplecarver.com/tool.php?toolname=WMDB%20Extractor%20for%20CurrentDatabase_372

Windows Media Player is a multimedia, video and music player program developed by Microsoft and comes installed as part of the Microsoft Windows operating system. Windows Media player will search a computer for compatible multimedia file types and automatically add to the library. A user can also add additional folders or storage devices containing supported file types. The library can be accessed via Media player, contents can be sorted, arranged and playlists created. The CurrentDatabase_372.wmdb is typically found on Windows 7.

The library is saved to a single file, each user profile will contain an individual library with the file extension wmdb – on Windows Media Player 12 this file is called CurrentDatabase_372.wmdb. Depending on the version of player installed the file may be called CurrentDatabase_360.wmdb, CurrentDatabase_219.wmdb or CurrentDatabase_59R. There may also be a file titled ‘CorruptDatabase_XXX.wmdb’ where X denotes a number.

The library file is located in the following location within each profile:

VOLUME\Users\PROFILE\AppData\Local\Microsoft\Media Player

Note: the location may vary depending on Windows Operating System version.

The Windows media player library file (for example CurrentDatabase_372.wmdb) can be readily examined using the tool ‘WMDB Extractor for CurrentDatabase_372.wmdb’, a forensic software tool which is part of the Simple Carver Suite. The WMDB Extractor for CurrentDatabase_372.wmdb is capable of reading the wmdb file and save the contents to CSV, TXT and HTML file formats.

WMDB Extractor for CurrentDatabase_372.wmdb:
http://www.simplecarver.com/tool.php?toolname=WMDB%20Extractor%20for%20CurrentDatabase_372

The Media player library file (example: CurrentDatabase_372.wmdb) contains a wealth of information including but not limited to File Path information, file properties, play counts, playlist information, video, music and photo file listings.

Using FTK forensic software to detect SQLite Database Files

The forensic software tool FTK can be used to good effect for identifying and extracting SQLite database files from a case for further processing using SQLite Forensic Reporter.

Once a case is processed in FTK navigate to ‘Databases’ under ‘File Category’. In the file listing window sort by ‘File Type’. Any identified SQLite database files will be listed under ‘SQLite Database’. The files can then be selected and exported from the case.

SQLite Database Files in Forensic Software FTK

Once the SQLite database files are copied from the forensic tool kit they can be processed using SQLite Forensic Reporter.

More info about SQLite Forensic Reporter here for batch processing SQLite Database Files in a case

SQLite Forensic Reporter how to process unknown databases

SQLite Forensic Reporter is the only tool available which uses template based SQLite DB processing. Any database that is not corrupted can be processed. Analysts and technicians will be able to quickly create new templates and decode data for themselves saving both time an processing costs.

Available for $125USD per license

View the video showing how to process unknown SQLite databases here:

Simple Carver Suite v4.4 Released.

A new version of SC Suite is available, version 4.4 now includes more tools to analyse and extract information from a variety of file types and utilities to assist in every day tasks. Continuing user feedback has resulted in the development of 71 tools packaged as a single suite for $95 per license…

What’s new:

• Quick Search v1.0, small powerful utility for performing text and hexadecimal search on files…
• Gather Window Names v1.0, research tool for extracting the window titles from all hidden and visible windows on the running Operating System…
• Read Time Zone Information v1.0, reads current time zone settings on a running Windows Operating System…
• Various existing tool improvements…

A full listing of the tools can be found here:
Simple Carver Suite – All Tools

In addition to the above new additions SC Suite includes the following tools:

• Hex Map v1.0, file format research/presentation tool…
• Format Seconds v1.0, a research tool which will batch converts seconds to a formatted hours/minutes and seconds…
• Contacts.edb Extractor, a tool designed to extract information contained within the Windows Live Messenger (WLM) contacts file (contacts.edb) file.
• Windows Photo Gallery Viewer (WPG Viewer), is a tool designed to view and extract information contained within the Vista Windows Photo Gallery data file (pictures.pd4).
• Archive View, standalone archive viewer supporting many of the popular archive file formats and more…
• Byte Swapper, a utility useful for conducting research and assisting data recovery allowing the user to manipulate the byte order of a file…
• Create Folders, utility designed to reduce the repetitive task of folder creation through the use of pre-designed templates…
• Delete Files, a utility for batch removing empty files from folders(s)…
• Disk List, lists all physical disks on a computer…
• Disk Map, utility used to create diskette images for test validation or file carving exercises…
• Eml2HTML, a utility for batch converting standard MIME email messages into HTML format report…
• EXE Extractor, batch extracts all version information that may be present within executable and library files…
• File Lister, searches for files using typical wildcard/mask or by using advanced regular expressions…
• Filecat, categorises file types(s) based on file extension/file header information, 100% user configurable…
• FileExt Renamer, batch renames file extensions based on the content of the file (file headers), ideal for recovered data by third party tools…
• Frag View, standalone utility for reviewing ‘web-based’ fragments…
• Frequency Count, very useful tool for counting the number of occurrences of words within a file…
• FTPThumbs Extractor, tool to extract and present the contents of the thumbnail database cache created by the WS_FTP software…
• Grep Test, basic grep testing utility, very useful for research and developing new search terms…
• Gzip Auto Extract, batch decompresses gzip files, useful for inspecting compressed live/recovered web content…
• Hash File, basic MD5 hashing tool…
• Header Grab Advanced, useful research tool, reads the file header and extension information from a specified volume/folder, stores this information in an Access database for review…
• HP Thumbs Extractor, a new tool for extracting and presenting the content of the thumbnail cache files created by the HP Digital Imaging and HP Photosmart Essential software…
• HTML Viewer, 100% standalone HTML viewer…
• List Video Codecs, lists all currently available codecs installed on the computer system…
• PMBThumbs Extractor, tool to extract and present the contents of the thumbnail database cache created by the Sony Picture Motion Browser software…
• PPThumbs Extractor, tool to extract and present the contents of the thumbnail database cache created by the Photophilia software…
• PSP Browse File Viewer, tool to extract and present the contents of the thumbnail database cache created by the Paint Shop Pro software…
• Registry Examiner, offline registry viewer supporting registry files from WinNT and above…
• Sector Search, identify fragments of a known file anywhere on a disk image, or compare the contents of two files at the sector level…
• Simple Carver, basic data recovery software, the first tool released starting this suite!
• Skype Extractor, a utility for viewing and extracting user information from the Skype user data files (call logs, contacts information, sms messages, chat messages and more…)
• Sort Folder, automatically sorts the contents of folder(s) into more manageable sizes…
• Structured Storage Extractor is a utility for reading and extracting information from the Structured storage format (ole container) files.
• Text Extract, useful analysis tool which extracts fragments of text from any file…
• Title Extractor, batch extracts the field information from all specified web pages…
• URL Previewer, batch extracts the information from Windows URL files, auto decodes date/time information and presents in a single report for review…
• Video Previewer, utility for creating preview reports producing a basic report showing the overall content of a video file (based on Media Player Classic thumbs option)…
• Vista Recycle Bin Reader, utility to read the recycle bin records of the recycle bin in Windows Vista…
• Windows Search Index Extractor, extracts information that may be present within the Windows Desktop Search Database (windows.edb file)…
• WinHex POS Viewer, a new tool to view and extract the content of POS files (Winhex search results) used by the Winhex program. Useful if you need to use the results from a previous search within a third party tool.
• WinThumbs Extractor, tool to extract and present the contents of the thumbnail database cache created by Windows OS…
• WMDB Extractor, a tool designed to extract information contained within the Windows Media Player data file (CurrentDatabase_360.wmdb). Extracts playlist, video, music and photo information to CSV, HTML and Text file report formats.
• PicViewer Extractor, is a tool designed to view and extract information contained within the PicViewer picture browser thumbnail cache file.
• LAN Search, perform filtered searches for files and folders across a network
• ABCThumbs Extractor (ABC Viewer thumbnail cache/database)
• Directory Opus Extractor (Directory Opus thumbnail cache/database)
• WinNCThumbs Extractor (WinNC file management tool, thumbnail cache/database)
• WildbitThumbs Extractor (Wildbit Viewer thumbnail cache/database)
• ValThumbs Extractor (Vallen Jpegger thumbnail cache/database)
• PIEThumbs Extractor (Picture Information Extractor software)
• Windows Live Photo Gallery Viewer (WPG Live Viewer), is a tool designed to view and extract information contained within the Vista Windows Live Photo Gallery data file (pictures.pd5).
• XLS Worksheet Detect, a tool for detecting hidden worksheets in Microsoft excel spreadsheets supports both xls and xlsx formats
• Windows Reg. Extract, a tool for previewing operating system ownership details
• Split Paths a utility which breaks down file paths into component parts and saves to CSV
• Worksheet Name Extract a utility for reading and extracting the titles of all worksheets from excel spreadsheet files
• Chrome Thumbs Extractor for extracting webpage thumbnails from the Google Chrome browser software
• Intel Extract, fully user configurable intelligence gathering tool gathers webmail activity (usernames, email addresses and more), search engine activity (default covers all main search enqines), online auction activity, online shopping activity and more…
• Drive Harvest, file/folder caturing for ‘offline’ review, includes powerful SQL search querying for searching and filtering…
• CSV2HTML, portable utility for quickly converting CSV formatting text to HTML format…
• Base64 Decoder, standalone base64 file decoder, works on single and multiple encoded files…
• Tested on Microsoft Windows 7 64-bit
• Windows Mail Store Extractor v1.0, extracts information from the Windows Mail repository file WindowsMail.MSMessageStore…
• PicIT Extractor v1.0 extracts thumbnail and associated data from the Microsoft Picture It thumbnail cache (piorg.db cache files)
• New tool added, Average File Sizes v1.0, calculate the average size of a group of
  files, useful for determining the optimal carve size for specific file type recovery…
• New tool added, Filename Convertor v1.0, batch converts long filenames listing to
  short filename 8.3 format, useful for keyword search creation…
• Edit File Times v1.0, file date/time manipulation and research tool…
• Hash File Reviewer v1.0, standalone hash file previewer…
• Various existing tool improvements…

Simple Carver Suite costs $95 per license and includes all the above tools, includes free customer support and updates. www.simplecarver.com

SQLite Forensic Reporter v1.2 Released.

A new version of SQLite Forensic Reporter, Universal SQLite database examination tool is available, version 1.2 now includes more features to analyse, extract and report on information from any SQLite database (not corrupted or encrypted). Useful for Computer & Phone Forensic Analysts and Data Recovery Technicians. Searches, indentifies and decodes all SQLite database files in a case. Identify SQLite databases containing evidence you never knew existed. Available for $125 per license with discounts for Government and Law Enforcement Agencies…

What’s new:

• More templates added!!!
• Added Polish Language
• Password and Username Identification, scans all identified SQLite database files for possible user credentials (saved as a separate listing).
• Collates date and time activity from all identified SQLite database files in a case and saved as a seperate listing for timeline analysis
• Added Unattended Mode, Identification and Processing of all SQLite database files is performed with a single mouse click

SQLite Forensic Reporter is the only universal SQLite database examination tool available to date, more information :
SQLite Forensic Reporter (Universal SQLite database examination tool)

In addition to the above new additions SQLite Forensic Reporter also includes the following features:

• File Header Analysis for reliable file identification
• Advanced identification using automated Table Analysis, Column Analysis and Field Data Analysis
• Easy to manage template interface, create new templates for newly encountered database formats
• User optional extraction of ‘undecoded’ data during processing for raw data comparison
• Built-in MD5 hashing
• Date / Time display user customisable
• Once installed, can be setup and running in as little as 3 mouse clicks
• Unattended mode, process an entire case overnite, come back to the results in the morning
• Optional single folder or recurse folder
• Handles unlimited number of templates
• Templates are portable, develop and share with colleagues, can be stored locally or on a network location (ie mapped drive)
• Supports numerous datatypes including all known date/time formats presently used in SQLite databases
• User can select and decode columns using built in data types
• User can selectively extract rows and columns matching any criteria using SQL scripting
• Decodes Windows FILETIME Date/Time stamps (Big Endian, Little Endian, hexadecimal or numerical)
• Decodes DOS 32-bit Date/Time stamps (hexadecimal or numerical)
• Decodes Unix Date/Time stamps (Big Endian, Little Endian, Seconds, Millisecond and Precision based formats, hexadecimal or numerical
• Decodes MAC Absolute Date/Time stamps
• Decodes OLE Date/Time stamps
• Decodes Base64 Encoded Text
• Decodes PRTIME Date/Time stamps
• Decodes WEBKIT Date/Time stamps
• Decodes Julian Date/Time stamps
• Decodes Display Boolean values (user customisable, Yes/No, True/False)
• Decodes Uppercase Text
• Decodes Lowercase Text
• Decodes Text to Hexadecimal
• Decodes Integer to Hexadecimal
• Decodes Display number formatted as filesize (examples: 3 bytes,3GB,3TB)
• Decodes seconds to hours/minutes/seconds
• Inexpensive, affordable to both individuals and multiple users, additional discount is available to Law Enforcement & Government
• Identifies fields containing possible usernames and passwords
• Advanced Identification not available anywhere else
• Identify files that have there file extensions renamed, a technique used by developers for basic data protection. also may be used for malicious purposes
• Unicode enabled, reports will export text correctly (arabic etc)
• SQLite automatically creates reports in HTML and CSV formats decoded as the user specifies
• Utilitises both Default (simple SQL processing) and/or Advanced User Defined SQL querying, link and reference tables for automatic decoding and reporting
• SQLite is available in English, German, Spanish, French and Indonesian Languages

SQLite Forensic Reporter costs $125 per license includes free customer support and updates. http://www.filesig.co.uk/ Discounts are available for Government and Law Enforcement Agencies…

More useful software: www.simplecarver.com

Processing SQLite Databases using Templates (applicable to forensic analysis and data recovery)

This article covers the processing of SQLite database files for forensic analysis, security auditing and data recovery purposes.  A growing number of software applications on computer systems and mobile devices are using SQLite database to store data.  A few examples of usage of SQLite databases includes but is not limited to:

• Software settings, SQLite databases are used to store not only general settings for software applications but you will also find user specific settings.

• Chat history, a number of products use SQLite databases for storing conversations between users on computer and mobile devices.

• Keyloggers, some key logging software use SQLite databases to store all recorded information and is well suited being capable of writing and holding millions of records containing pictures and text information.

• Virtually and data can be stored in a SQLite database…

SQLite databases typically consist of a single (sometimes multiple files linked) with each database file containing one or many tables.  Each database table will contain a certain number of columns in a set order and each row or record will store data accordingly.  SQLite databases can store virtually any data including:

• Text – this could be human readable or encoded
• Date and Times – any date format or specification of designers choosing
• Binary (BLOB) – this can be pictures, documents or any data of designers choosing.

Problems and Issues

• Due to the growing number of SQLite databases present in both computer and mobile devices the time to open, process and review the data contained within each SQLite database is becoming problematic.

• Formats change, from time to time SQLite databases for a specific product will be updated, columns removed or added, tables renamed or removed and so on.  When these changes occur it can prevent software designed to process a specific SQLite database from working correctly or produce incorrect results.

• Simple Calculation: Quantity of SQLite databases to analyse x Using the correct tool for each database x Time to Process each database x Review each database = A LOT OF WASTED TIME!

Solution

Template processing SQLite databases is an automated method of batch processing SQLite databases for end user review.  First correctly identify each SQLite Database by user configurable identification of internal and external file properties then process each table and each column in the correct matter with as little user intervention as possible.

1. Correctly identify each database – this must be user configurable!  If a new SQLite database is encountered then allow the user to identify characteristics associated with the given database.  For example: File header and internal settings of SQLite database.

2. Correctly process each table in turn and columns within each table for a particular SQLite database – this must be user configurable!  If a new SQLite database is encountered or a small variation occurs in an existing database the user can create a new template to deal with this.  At this stage custom queries can be devised to filter and/or present data in a similar fashion to that presented to the user as originally intended.

• There are infinite variations of how a table in a SQLite database can be laid out.  How the data is actually stored within each column is typically only limited to a handful of data types.

SQLite Forensic Reporter in a Nutshell

SQLite Forensic Reporter allows you to process virtually any SQLite database using predefined templates.  SQLite Forensic Reporter is template driven and fully user configurable which means when a new SQLite database is identified a new template is created by the user.  Columns are processed correctly and decoded if required using built in processing routines for date/time formats etc.  The user has full control and does not need to wait for an update from the software developer.  SQLite Forensic Reporter batch processes SQLite database en-masse greatly reducing the time to extract and present data from SQLite databases present in both computer and mobile devices.

For more information: http://www.filesig.co.uk/sqlite-forensic-reporter.html

SQLite Forensic Reporter is $125USD per license and priced to be affordable to both individual and organisations alike.

The use of Forensic Data Recovery Software in Different Sectors

These days, catching a criminal involves the use of highly sophisticated technologies which can generate vital evidence good enough to prove whether a person is really guilty or not. One of the known applications that can be taken under consideration in such cases is the forensic software or data recovery software.

A forensic software can help the law enforcement agencies to retrieve deleted files from a suspect’s computer. It can also be used to check with his/her e-mails, faxes and browsing history which can lead to vital breakthroughs. This is why forensic software are considered as an important tool for the investigators.

However, forensic software can also be used by general people for recovering important data that got deleted. If you have mistakenly erased a very important file from your computer or in case the hard drive got damaged, the forensic data recovery software will help you out to retrieve the lost data.

In this day and age, the digitalization of business organizations has changed the corporate trends in various ways. Now firms can store enormous amount of data in their computers that are easy to access and at the same time reduces the cost involved with the use of paper. But digitalization of data storage also comes with a major problem. That is, the fear of losing valuable data due to some accident.

A significant number of business organizations in the world have faced devastating consequences due to data loss and some of them even had to file for bankruptcy at a later stage since it became difficult for them to recover from the damage.

For a business organization, its data can be one of its most important assets which are needed to be protected and maintained carefully. Therefore, it is important for an organization to establish a reliable data recovery system that can play a key role in difficult times to recover vital data when it is needed.

From the perspective of a student, just think of an individual who might have just lost his or her academic report or thesis paper due to hard drive failure which has to be submitted tomorrow morning. In such cases, it might turn out to be completely impossible to meet the deadline. This is when a forensic data recovery software can come handy to recover the lost file or data.

Now there are many data recovery software available in the market and you can buy one over internet. But before making the final purchase, I would recommend you to do some research to find the right product for yourself. A software offered by a reputed company is obviously a safer choice and you can expect a better after sales service from them too.

So do consider going for a forensic software for data recovery if you have lost valuable files or data from your computer. They are affordable and can provide you the expected result.

Forensic Data Recovery Software- One that can save the day

Have you mistakenly deleted a vital document from your pc and now desperately searching over internet regarding ways to recover lost data? Well you might have just bumped on one of those sites of a data recovery expert who is offering professional help for retrieving any type of lost data from your computer.

Before making the call, I would request you to consider going for a forensic software or data recovery software first which might just do the trick for you but at a lower price. There are forensic software available in the market that can help you with recovering deleted files or data from a broken hard drive. All you need to do is select the right one which will be able to give you the expected result. How? Let me explain.

Always try to go for a renowned data recovery software which has a rich background and satisfied customers. This will safeguard you from any sort of scam that can waste both your time and money. Now of course that does not necessarily means every other new product is ineffective but if you want to stay safe and not looking for anything adventurous, you might go for the conventional way that is buying a forensic software which is already tried and tested by others.

Look for the packages that come with multiple forensic, data recovery and e-discovery tools. These offers can cover a wide range of needs for you by providing various services so that you don’t have to buy multiple products one after another whenever a need arises.

One of the smartest ways to establish an effective damage control system is by thinking in advance regarding the possible difficulties that you might face. This is why you should choose a data recovery package that comes with multiple applications that can come handy in the future.

Utilize the customer support facility provided by a company through their website. This is a great way of having some level of understanding regarding the product or service of an organization. If they look sincere and efficient while responding to your questions, there is a possibility that you can rely on their products. Usually the responsible and reliable companies realize the necessity of a strong customer support system. So make the best use of it before buying a forensic software.

Loss of valuable data can turn out to be devastating for your organization and should be dealt with maximum sincerity. A data recovery or forensic software can save you thousands of dollars by retrieving your lost information. So don’t underestimate the importance of a data recovery application. Keep one as an important tool for your everyday business.

Data recovery is not a very complicated task as long as you are using a reliable forensic software to get the job done. With little research and patience, you can end up having the right software that can save the day for you.

Forensic Software for your Business Organization- How to Avoid Potential Losses

In this day and age, data is considered to be one of the most valuable assets for a business organization. As a matter of fact, for some firms they can be even more important than their tangible assets. If you are running a business that deals with loads of customer data that are stored in your computer hard drive, it can turn out to be devastating if that information gets deleted due to some unfortunate incident. With the world getting more digitalized day by day, the necessity of having a well organized data recovery plan has become a must for the business organizations since the nature of the data that you might have lost can cause thousands if not millions of dollar for your organization.

This is when a forensic data recovery software can become extremely important. The software is programmed to retrieve any deleted or lost file from a system and thus can help you to avoid any kind of significant loss. The data recovery software are not only useful in recovering files but they can also be used to classify and manage your files in an orderly fashion which is also important for the business organizations to operate efficiently.

Now you might wonder why should you go for a data recovery software to retrieve your lost data instead of calling an expert to get the job done. Well one of the key reasons why I would recommend you to use a forensic software or data recovery software initially is because they are cheaper in comparison with the expert service. So if such a software can actually solve your problem, you really don’t have to call in a data recovery expert and pay him/her loads of cash for the service. However, in cases where the software might come up with any limitation, you can go for expert help to solve the problem. But I think initially you should consider trying out a forensic software to see if it can serve the purpose for you.

So of you are now planning to buy a forensic software, where do you go? Well no where! Just sit in front of your pc and search for reliable forensic data recovery software online. You will have a list of websites in no time which will offer you data recovery tools that you can buy over internet. But make sure that you are choosing a renowned company so that the tool(s) that you are purchasing are reliable and effective. Utilize the customer support of the company to learn more about their software.

If you are yet to establish an effective data recovery system for your business organization, I think it is really important for you to start planning for one right now. Try forensic software to fulfill the requirements. This little investment can save you thousands of dollars.

4 Important Things that you should know about Forensic Software for Data Recovery

If you are entirely new with the concept of forensic software for data recovery, you have every reason to get curious about these programs. Well in this article I will try to shed some light on some of the basic information that you should know regarding forensic data recovery software.

1. What can you do with a forensic data recovery software?

The primary use of a forensic data recovery software or simply forensic software (aka data recovery software) is to retrieve lost data from a computer. Worked really hard for the last couple of days with your financial statement or report that you never backed up? Then you might feel all crushed if your hard drive simply goes out of order with all your valuable data inside. This is when a forensic data recovery software can help you out by retrieving those lost data. It is programmed to recover files that were deleted by the user (either accidentally or intentionally) or got lost due to a hard drive crash.

2. What else can be done with a forensic software?

There are various types of forensic software that you will find in the market and not all of them are going to provide you with the same type of service. There are some programs available out there that are capable of conducting file analysis, identification, classification as well as file management. So you can say that this is more like a multi tasking software that can be used for maintaining files in your computer in an organized way.

3. Why do they call these programs as “Forensic software”?

Well by the look of it, now you know that these programs are well capable of retrieving lost data from a system. It can be either a file that was erased from the hard drive, an e-mail, browsing history or even faxes. Therefore this software has become a very important tool for the law enforcement agencies to retrieve valuable information from a suspect’s computer that can be used as important evidence for a case. A reason why the software is know as forensic software.

4. Can you run a forensic software on just any operating system?

Your system needs to be compatible to run certain forensic data recovery software. There are certain programs that can run in all the Windows versions including Windows 98, XP, Vista and Windows 7 while some requires the computer to have at least Windows XP to operate. You just need to go through the requirements mentioned in the product description.

So now you know the importance of a forensic data recovery software. In this day and age where a significant portion of our everyday life is turning digital, I think it is important for all of us to consider having a forensic software in the armory. You will never know when it might come handy to save the day.

Data recovery service can be really expensive if you are hiring a professional to get the job done. But with use of forensic software, you can actually reduce that cost significantly and still get a quality service to retrieve lost data from your system.