App database mapper
App data is often stored within SQLite databases. XRY does not support decoding for all apps used in all countries. Using App database mapper, you can manually map data in SQLite database tables to artifacts in the XRY file.
Procedures
Open the App database mapper
- Find an SQLite database of interest and expand the SQL viewer in the Details pane.
- Optionally, you can open the SQLite viewer in a new tab using the Show in a new tab option
in the context menu behind the three dots button. - In the SQLite viewer, select the database table of interest.
- Click the Manually map the content of the selected database table to artifacts button
to open the App database mapper.
Map SQLite data to artifacts
- Select an artifact category or a template, and follow the instructions in the tool.
- Each column in the database table can be mapped to an artifact property. For time stamps, you also need to specify the time format.
- When you have mapped the columns you want to map to artifact properties, you can save the mapping as a template to use next time you need to map the same database table to artifacts in another data source. The mapping is saved as a .json file.
- After the import, your manually mapped artifacts are opened using the Examiner Mapped Data filter.
