Digital forensics / all software
Deep Table
App databases, deleted records included
Most of the evidence on a phone or computer lives in app databases. Deep Table shows what's in them now, what was deleted or overwritten but not yet destroyed, and the order things happened in.
The problem it solves
Opening a database with ordinary SQLite can checkpoint the WAL and destroy the very records you want, and the interesting values are buried in BLOBs, plists, protobuf and unusual timestamp formats. Deep Table works on verified copies, parses the files itself, and decodes what apps hide.
Who it's for: Digital forensic examiners working on app data from phones, computers and browser profiles.
What it does
- Originals untouched. Every file is hashed, copied and verified before it's read. The copies are opened read-only, and every write is refused.
- Deleted record recovery. Carves records from free space, freelist pages, WAL frames and journals, and marks each one deleted, older version or live copy, with a confidence rating.
- WAL timeline. Replays the WAL one commit at a time and lists every row inserted, updated or deleted. View the database as it was at any commit.
- Browser storage decoded. Chrome, Edge and Electron Local Storage, Session Storage and IndexedDB become tables, with IndexedDB values as JSON.
- Timestamps and BLOBs. Timestamp formats detected per column and shown in UTC. BLOBs identified and previewed, with a decode chain for data wrapped in other data.
- Search, SQL and reports. One search across every table, a read-only SQL editor and query builder, and bookmarks that go into an HTML or JSON report with the evidence hashes.
At a glance
- Platform
- Windows 10 and 11
- Formats
- SQLite with WAL and rollback journal, LevelDB (Chrome, Edge, Electron)
- Outputs
- HTML / JSON report, CSV, BLOB export with manifest
- Works offline
- Yes
- Pricing
- From £495, then £125 a year
Good to know
- LevelDB compaction drops superseded records, so its timeline is what's left, not complete history.
- Each recovered record shows the page and offset it came from. Check it before relying on the record.
Deep Table is in development
It isn't on general sale yet. Request early access to use it on your own material before release, report what works and what doesn't, and help shape the finished version. Early-access users get launch pricing locked in.
Planned launch prices, excluding VAT. A unit licence covers every workstation in one force's forensic unit.
- Try it before release on your own material
- Direct line to the developer for feedback
- Launch pricing locked in for early-access users