Initial commit - 611 cybersecurity skills across all subdomains

skills/performing-sqlite-database-forensics/references/workflows.md

@@ -0,0 +1,39 @@
+# Workflows - SQLite Database Forensics
+
+## Workflow 1: Complete Database Analysis
+```
+Identify SQLite databases in evidence
+    |
+Create forensic copies (preserve WAL and journal files)
+    |
+Analyze database header (page size, encoding, freelist)
+    |
+Query active tables for evidence
+    |
+Analyze freelist pages for deleted records
+    |
+Parse WAL file for transaction history
+    |
+Examine unallocated space within pages
+    |
+Decode timestamps (Chrome, Unix, Mac Absolute, Mozilla)
+    |
+Document and export findings
+```
+
+## Workflow 2: Deleted Record Recovery
+```
+Open database in hex editor
+    |
+Identify freelist trunk/leaf pages from header
+    |
+Extract raw page data from freelist
+    |
+Parse B-tree cell format to decode records
+    |
+Check WAL for pre-deletion snapshots
+    |
+Examine unallocated space between cell pointers and content area
+    |
+Carve recoverable records
+```