## 1 Introduction  
The mobile phone industry has undergone significant growth in recent times [1], with people using their phones for more than just making calls or sending messages. Activities such as web browsing, sharing media, online shopping, playing games, and social-media networking consume most of the time spent on mobile phones [2]. With the increasing use of mobile devices such as smartphones and tablets, they have become a prime target for various cybercrimes, such as hacking, data theft, and malware attacks. As a result, the demand for mobile forensics to help investigators gather and analyze digital evidence from these devices to aid in criminal investigations has increased. Mobile forensics is a branch of digital forensics that deals with the recovery and investigation of digital crime evidence [3]. It involves the recovery and analysis of data from mobile devices, including call logs, text messages, emails, social-media activity, and location data. It requires the use of specialized techniques and tools to acquire, analyze, and interpret data from mobile devices, such as call logs, text messages, emails, photos, and videos. The ultimate goal of mobile forensics is to provide reliable and admissible evidence which can be used in legal proceedings. The process of recovering digital evidence from mobile devices using accepted methods under forensically sound conditions is referred to as mobile forensics, according to the National Institute of Standards and Technology (NIST). Mobile-device forensics is a rapidly evolving specialty in digital forensics that involves collecting and analyzing data from smartphones and tablets while maintaining the data's integrity. These data can be used as evidence in legal proceedings, which is why law enforcement agencies and private organizations involved in forensic investigations use specialized tools and techniques to extract and analyze digital evidence from mobile devices. NIST has issued a comprehensive guideline document, 800-101, which provides detailed instructions for conducting digital forensic investigations on mobile devices. This document encompasses a wide range of subjects related to mobile device forensics, including the mobile device forensic process, data acquisition, and analysis of mobile devices, as well as evidence preservation, legal considerations, and best practices. The process of mobile forensics, as per NIST 800-101, involves identification, preservation, collection, examination, analysis, and reporting. SQLite databases are regarded as critical sources of digital evidence in forensic investigations when found on mobile devices. This is because SQLite is a database management system commonly used on mobile devices which stores various types of data, such as call logs, text messages, and internet history. Extraction and analysis of SQLite databases from mobile devices play significant roles in mobile forensics investigations, as they provide investigators with valuable information, such as the communication history of a suspect, web searches, and other digital artifacts relevant to an investigation. Investigators commonly use tools such as Belkasoft, Magnet AXIOM, and FINALMobileForensics to extract and analyze digital evidence, including SQLite databases, from mobile devices. These tools have features and capabilities such as data recovery, file carving, and timeline analysis to aid investigators in identifying and analyzing relevant digital artifacts from mobile devices. Research on SQLite evidence extraction in mobile devices is a rapidly developing field. A range of studies in digital forensics address key challenges and advancements in the domain. One study [4] underscores the evolving landscape of mobile devices, one which necessitates adaptive forensic methods due to changing security features and levels of encryption adoption. Another research effort [5] adopts agile methodology to develop forensic modules for Android social media and messaging apps, detailing implementation and challenges.