Rekall provides access to XBase format files using an SQL wrapper XBSQL which implements a limited subset of SQL.
Currently, the XBSQL driver which accesses XBase format files supports the following:
select e1, ... from t1, where c1 ... order by o1, ...
insert into t values (e1, ...)
insert into t (c1, ...) select ...
insert into t select ...
insert into t (c1, ...) values (e1, ...)
update t set c1 = e1, ... where c1, ...
delete from t where c1, ...
create table t (colspec, ...)
drop table t
Expressions e1 are currently fairly limited, just some basic arithmetic and string concatenations, plus equality/inequality, greater/less greater-or-equal/less-or-equal.
Available column types for create column specifications are:
int
double
char
blob
date
XBase files all contain fixed-width columns, with the exception of the blob type, which maps to a memo column. The first three cases can therefore have (width) appended. Individual columns can be indexed, for example, (...., ident int(10) index, ...).
Note the XBase has no notion of a not-null column, nor of a primary key. The latter is handled by Rekall using a 22-character wide char column, when it is the first column in the table; Rekall generates key values which are almost guaranteed to be unique ( The key value is generated by concatenating the system time (in seconds since the epoch) at which the driver is started, with a serial value which is incremented by one for each key generated. Hence, an example key is 1008341402.000000023 ) .
Note that in the table designer, int appears as decimal.
Unsupported SQL includes
sub-selects
create .... as
alter table ...
inner, etc., joins