Importing sql extension files (.sql)

[Lucio-hub]

Hello!

What is the procedure to import the .sql files (2024.06.1 Delta SQL Downloads) available at the link,
https://www.nist.gov/itl/ssd/software-quality-group/national-software-reference-library-nsrl/nsrl-download/current-rds?

[wladimirleite]

Hello @Lucio-hub!

These delta files are meant to update a previously downloaded NSRL full database (follow instructions available on NIST website).

Once you have an up to date NSRL SQLite database, you can import it into an IPED hashes database.
There are more detailed information in https://github.com/sepinf-inc/IPED/wiki/User-Manual#hashes-database-version--400, but basically it is just a single command:
java -jar lib/iped-hashdb.jar -d <input> -o <output>,
where <input> is the full path of the NSRL SQLite you want to import and <output> is the full path of the IPED hashes database (created if it does not exist).

A side note, for IPED evidence processing, it is important to place the hashes database SQLite in a fast disk (SSD, if available).

[Lucio-hub]

Hello, when executing the command indicated in IPED 4.1.6, I receive the message:

Com a versão java instalada no sistema:

[wladimirleite]

There is an specific remark about that error in the Wiki's section that I mentioned above.
Basically you need Java 11.
If you are using Windows, you can simply use the embedded JRE through jre\bin\java -jar lib\iped-hashdb.jar ....

[wladimirleite]

@Lucio-hub, did you manage to import the NSRL hash sets?

[Lucio-hub]

Dear,
The file import process (.sql) failed. The (.sql) file does not have the same table structure as the .db file that I already have and which was generated via line command in IPED itself.
I will wait for the most updated FULL SQL DOWNLOADS versions to become available.

[wladimirleite]

@Lucio-hub, let me try to clarify a bit further...
NSRL hash sets SQLite's and IPED hashes DB SQLite are completely different things.
IPED can import NSRL SQLite's, but not .SQL delta files.
So the whole procedure is:

1. Download a FULL version of NSRL hash sets.
2. Download a DELTA version of NSRL hash sets.
3. Apply the DELTA to the FULL NSRL SQLite.
4. Import the NSRL SQLite into IPED hashes DB SQLite.

For step "3", you may use SQLite tools (available from https://www.sqlite.org/download.html) and then:

• Open the FULL database: sqlite3.exe RDS_2024.03.1_android_minimal.db
• Apply the DELTA: .read RDS_2024.06.1_android_minimal_delta.sql

[Lucio-hub]

I'll try again. I was using the DB Browser tool for SQLite version 3.12.2 for this task.

[wladimirleite]

It may work with DB Browser, but I haven't tested it.
However, the key point is to import the NSRL DELTA into the NSRL FULL SQLite, not IPED's hashes DB.

[Lucio-hub]

Okay, should I always use the "minimal" versions?

[wladimirleite]

Okay, should I always use the "minimal" versions?

It is not a hard requirement, but I always use the "minimal" versions myself and recommend to use them when importing to IPED as the "full" version would increase required space, for the hashes DB SQLite but mainly to the indexed cases, without adding useful information.

[Lucio-hub]

Okay, I'll adopt this procedure.
Thanks!