<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Database Forensics

## mysqlbinlog

**Decode MySQL binary logs to SQL statements.**

```bash
# Full decode
mysqlbinlog --no-defaults --base64-output=DECODE-ROWS -v binlog.000042

# Time-filtered
mysqlbinlog --no-defaults --start-datetime="2026-03-10 00:00:00" \
  --stop-datetime="2026-03-17 23:59:59" binlog.000042

# Database-filtered
mysqlbinlog --no-defaults --database=target_db binlog.000042
```

| Flag | Description |
|------|-------------|
| `--base64-output=DECODE-ROWS` | Human-readable row events |
| `-v` | Verbose — show column values |
| `--start-datetime` | Start time filter |
| `--stop-datetime` | End time filter |
| `--database` | Filter by database name |

## pg_waldump

**Parse PostgreSQL Write-Ahead Log files.**

```bash
pg_waldump /path/to/pg_wal/000000010000000000000042
pg_waldump -s 0/1500000 -e 0/1600000 /path/to/wal_file
```

| Flag | Description |
|------|-------------|
| `-s` | Start LSN |
| `-e` | End LSN |
| `-n` | Limit number of records |
| `-r` | Filter by resource manager |

## SQLite3

```bash
sqlite3 evidence.db ".schema"
sqlite3 evidence.db ".tables"
sqlite3 evidence.db "PRAGMA freelist_count;"
sqlite3 evidence.db "PRAGMA journal_mode;"
sqlite3 evidence.db "PRAGMA wal_checkpoint(PASSIVE);"
```

## undark — SQLite Deleted Record Recovery

```bash
undark -i evidence.db                    # Recover deleted records
undark -i evidence.db -e evidence.dump   # Export to file
```

## MSSQL — fn_dblog

```sql
-- Read transaction log
SELECT [Current LSN], Operation, Context, [Transaction ID],
       [Begin Time], [Transaction Name]
FROM fn_dblog(NULL, NULL)
WHERE Operation IN ('LOP_DELETE_ROWS', 'LOP_INSERT_ROWS');

-- Find specific transaction by SID
SELECT [Begin Time], SUSER_SNAME([Transaction SID]) as [User]
FROM fn_dblog(NULL, NULL)
WHERE [Transaction Name] = 'DROPOBJ';
```
