ogmini - Exploration of DFIR
Having fun while learning about and pivoting into the world of DFIR.
About Blog Research CTF/Challenge GitHub RSS
Remote Desktop Manager - Artifacts Part 3
by ogmini
Busy day at work today. Didn’t have much bandwidth to poke around Remote Desktop Manager. I’ve always found it useful to utilize Database Diagrams to both understand and explain a database’s data structure. For SQLite databases, I use a tool called Dbeaver to easily auto-generate the Database Diagram for me and give me a good base to start better documentation. Oddly, I still prefer using SQLite Browser to examine the data. I’ve attached the generated image below.
Now remember, this Database Diagram is auto-generated and SQLite does not enforce relationships between tables in the same way as more robust RDBMS systems like PostgreSQL or MySQL. This requires manually fixing. Just as an example, Attachment records have a “ConnectionID” which references the “ID” in the Connections records. This relationship is not represented in the Database Diagram. Dbeaver is taking guesses the best it can.
tags: DFIR - Remote Desktop Manager