QuickBooks Forensics

Data Access, Analysis, Review, Export and Recovery QuickBooks company files are based on SQL Anywhere database engine and any digital analysis is challenging due to the nature of database engine workflow: there are automatic cleanups and optimizations (data pages are being moved, cleared or deleted); file is modified even prior to user login with database startup details and counters; there are lots of SQL functions, events and triggers involved. QuickBooks Forensics is designed to provide full direct read-only access to all tables (records) saved in QuickBooks '.qbw' files. It is based on reverse-engineering of database format and works with files directly without any database engines. Additional technical details are available for data analysis (for example precise timestamps are present in most tables). Data is not changed in any way and can be accessed or extracted repeatedly in contrast to standard access methods. It is the first tool to offer low-level data access to QuickBooks company files. QB Forensics also searches and recovers old records / discarded data pages with old or lost data. QB database tables can be previewed for preliminary analysis and / or exported as XML file with proper XSD schema to be used in MS Access, Excel, etc. Search feature is available to look for specific records in all or selected tables. User preferences, system settings, access history, Apps details and other parameters are pre-extracted and shows to simplify data review and analysis. Attached binary and text blocks of data can be previewed in internal Hex viewer or extracted for further analysis. UID & PWD Calculator is available to assist in company files data editing in SQL Anywhere. QuickBooks Forensics can also be used to extract QB Point of Sale backups ('.qpb' files) and preview POS 'qbpos.db' databases. Please contact us for QBPOS password recovery and UID / PWD generation.
Transaction Logs
'.TLG' files are database transaction logs (history of all actions executed by the database engine). The transaction log is a key component of backup and recovery. QuickBooks Forensics sorts log transactions based on tables affected, thus tables history can be tracked step by step. You can also check our notes on how to learn QB internals from QuickBooks Transaction Logs.
Sensitive Data:
Small subset of data is called "sensitive data" and includes: CC numbers, SSNs, Tax IDs, SINs, company EIN and Bank accounts and routing numbers. It is encrypted with "sensitive data keys".QuickBooks Forensics can decrypt them automatically without any additional data using number of security flaws (QB 2016 upto R5 [up to May 2016] or with '.SDU' files in QB 2017 upto R4 [up to Jan 2017], ...).For patched versions there are number of ways to recover sensitive keys: enter known password or use password recovery for any company file user, export sensitive data keys from an old version (with recoverable keys, known passwords, ...) and import into current versions.
Password Replacement: Please check our notes on QuickBooks Password Replacement. Password verification values can be replaced instantly in order to regain access to protected company files. Sensitive data encryption keys are usually recoverable, thus full data access can be restored. Even in worst case scenario (unrecoverable keys, all users with very complex passwords, no prior versions to export keys from, etc.) you still can replace QuickBooks "Admin" password and open company data file, but without access to credit card, tax and bank account numbers, if any are present.
Password Recovery:
User password might be useful outside of the QB environment, therefore password search is available for Admin and non-Admin accounts. QuickBooks Forensics allows you to queue several attacks for precise search range setup including a very flexible mixed attacks (combination of wordlist, brute-force and fixed parts). Additional modifications are available: keyboard layouts-aware recovery technique, char replacement (e.g. I or i with 1), etc.We did our best to enhance this tool performance as well as the recovery speed with some advanced methods and it found to be the fastest tool for QuickBooks password recovery.
Password recovery speed:
Password recovery speed is variable depending on additional information recoverable from the file, username, etc.
The following table is based on several tests with the common laptop, workstation and tablet CPUs (Mp/s = million passwords per second):

QuickBooks 2018-2024 password recovery with AMD and NVIDIA GPUs:
GPU support was added in QuickBooks Forensics to enhance performance of QB 2018-2024 password search. Several GPUs can be used in parallel to accelerate recovery even more. Below you can see several examples with entry-level, mid-level and enterprise-level cards.

Trial version is available to check format compatibility. It allows you to preview odd rows from any table. Export is enabled for tables "SYS..." and "ISYS...". Protection details are shown, but password replacement is disabled. You can setup and test run any password search for 15 min per set.