Skip to Content
SourcesSQLite

SQLite

SQLite

Scan tables in a local SQLite database file with no server required.

Category
Databases
Source type
SQLITE
Produces
table

SQLite is a whole database in a single file — which is why it turns up in mobile app backups, desktop applications, exported archives, and forensic images. If you have the file, you can scan it.

What you need to connect

A path to the file. There are no credentials, no host, no port — SQLite has no server and no login. The file must be readable by the scanning process, which in practice means a path on the desktop application’s machine or a volume mounted into the cluster.

What Classifyre reads

Every table in the file, or just the tables you list.

Shared behaviour · SQL databases

One asset per table or view, never one per row. The asset carries the table's structure — database, schema, table name, object type, its columns and their types, and a row-count estimate — and its content is a sample of real rows, formatted so a detector reads actual values rather than a schema dump.

How many rows, and which ones, is entirely up to the sampling strategy. Large tables are paged through by key rather than by OFFSET, so a scan that stops halfway can resume from where it left off instead of re-reading from the top.

Read-only throughout. The connector issues catalog queries and bounded SELECTs. Nothing is written back, and a read-only account is the right account to give it.

Relationships come out of the engine's own catalog: foreign keys are recorded as REFERENCE links — useful, but they move no data, so they never become a lineage hop. See Lineage.

Metadata on every asset

Asset kind · table

FieldTypeAlways presentWhat it is
databasestringYesDatabase or catalog name
table_namestringYesTable name
table_typestringYesObject type (TABLE/VIEW)
schemastringNoSchema name
columnsobject[]NoColumns as {name, type} objects
row_countintegerNoEstimated number of rows

Lineage

Lineage

Foreign keys are read and recorded as references, which maps out how the tables relate. SQLite exposes nothing about data movement, so there is no lineage — see Lineage & Relationships for the difference.

Worth knowing

  • The file is opened read-only. Scanning a database an application is actively using does not interfere with it.
  • Internal sqlite_* tables are skipped.

Configuration

Beyond the fields below, every source also has the settings shared by all of them: the sampling strategy, the detectors to run, the scan schedule, and the compute limits for its scan jobs.

Required

Without these, the source will not save.

FieldTypeRequiredWhat it doesDefault
requiredobjectYesno extra properties
database_pathstringYesAbsolute or relative path to the SQLite database file (e.g. /data/app.db)

Secrets

Stored encrypted and never shown again after you save them. See Configuration & Fields.

FieldTypeRequiredWhat it doesDefault
maskedobjectNoSQLite has no credentials; this section is intentionally empty.no extra properties

Optional

Everything you can tune. Sensible defaults apply when you leave them alone.

FieldTypeRequiredWhat it doesDefault
optionalobjectNono extra properties
scopeobjectNoTable selection scope.no extra properties
scope.include_tablesarrayNoOptional table allowlist. Only tables in this list will be scanned.
scope.include_tables[]stringNo
scope.table_limitintegerNoOptional cap on number of table assets extractedmin 1
Last updated on