The XBase interface

Rekall provides access to XBase format files using an SQL wrapper XBSQL which implements a limited subset of SQL.

Currently, the XBSQL driver which accesses XBase format files supports the following:

Expressions e1 are currently fairly limited, just some basic arithmetic and string concatenations, plus equality/inequality, greater/less greater-or-equal/less-or-equal.

Available column types for create column specifications are:

XBase files all contain fixed-width columns, with the exception of the blob type, which maps to a memo column. The first three cases can therefore have (width) appended. Individual columns can be indexed, for example, (...., ident int(10) index, ...).

Note the XBase has no notion of a not-null column, nor of a primary key. The latter is handled by Rekall using a 22-character wide char column, when it is the first column in the table; Rekall generates key values which are almost guaranteed to be unique ( The key value is generated by concatenating the system time (in seconds since the epoch) at which the driver is started, with a serial value which is incremented by one for each key generated. Hence, an example key is 1008341402.000000023 ) .

Note that in the table designer, int appears as decimal.

Unsupported SQL includes