SQLCipher Encrypted Database
| Format | SQLCipher Encrypted Database |
|---|---|
| Short name | SQLCipher |
| Category | database |
| Platforms | Windows, macOS, Linux, iOS, Android |
| Crush support | Supported (SQLiteParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
An SQLite database with every page AES-256 encrypted, used by messengers and other apps (Signal, WeChat, many Android apps). The first 16 bytes hold the random key-derivation salt in place of the SQLite header, so the file looks random and has no signature. Each page carries an IV and an HMAC; with the right key and settings (SQLCipher 4 defaults: AES-256-CBC, HMAC-SHA512, PBKDF2-HMAC-SHA512 with 256,000 iterations) it decrypts to an ordinary SQLite database. Apps can keep a plaintext header instead (cipher_plaintext_header_size, mainly for WAL databases in iOS shared containers): the file then begins 'SQLite format 3' but will not open as plain SQLite, and the salt is stored outside the file.
Signatures
None recorded
Known extensions
.db, .sqlite
References
- SQLCipher design — security approach and features (Zetetic) https://www.zetetic.net/sqlcipher/design/
- SQLCipher source (Zetetic) https://github.com/sqlcipher/sqlcipher
- SQLCipher 4, plaintext header and key salt (Zetetic discussion forum) https://discuss.zetetic.net/t/sqlcipher-4-plaintext-header-and-key-salt-problem/3282
Cite this entry
Crush Format Reference, “SQLCipher Encrypted Database”. https://kalink0.github.io/crush-forensics/formats/sqlcipher/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction