# What Database Does IPED Use? H2 for Case Metadata and SQLite for Forensic Artefacts

> Discover what database IPED uses for case metadata and forensic artifacts. Learn how IPED leverages H2 and SQLite for efficient data management in digital forensics.

- Repository: [Serviço de Perícias em Informática/IPED](https://github.com/sepinf-inc/IPED)
- Tags: internals
- Published: 2026-03-11

---

**IPED stores its case metadata in an embedded H2 database with asynchronous file access, while leveraging the SQLite JDBC driver to read forensic artefacts such as WhatsApp and browser histories.**

IPED (Indexador e Processador de Evidências Digitais) is an open-source digital forensic tool developed by the Brazilian Federal Police. Understanding what database IPED uses is essential for forensic investigators and developers extending the platform. According to the sepinf-inc/IPED source code, the application utilizes **H2** as its primary embedded data store for case management, alongside **SQLite** support for parsing third-party evidence files.

## Embedded H2 Database for Case Metadata

IPED persists its case metadata and preview data in an **embedded H2 database**. The `PreviewRepositoryManager` class located at [`iped-engine/src/main/java/iped/engine/preview/PreviewRepositoryManager.java`](https://github.com/sepinf-inc/IPED/blob/main/iped-engine/src/main/java/iped/engine/preview/PreviewRepositoryManager.java) manages the lifecycle of this database, constructing JDBC URLs with the `jdbc:h2:async:` prefix to enable asynchronous file operations.

The H2 driver is declared as a Maven dependency in [`iped-engine/pom.xml`](https://github.com/sepinf-inc/IPED/blob/main/iped-engine/pom.xml) (`com.h2database:h2`). When a forensic case is initialized, the repository manager creates a connection pool using **HikariCP** for efficient database access.

### Configuring the H2 Connection

The `PreviewRepositoryManager.configureWritable()` method establishes the database connection for a specific case folder. It generates a JDBC URL pointing to the case directory with optimized parameters for forensic workloads.

```java
// Configure a writable preview DB for a case folder
File caseFolder = new File("/path/to/case");
PreviewRepositoryManager.configureWritable(caseFolder);

// Later, retrieve the singleton repository
PreviewRepository repo = PreviewRepositoryManager.get(caseFolder);

// Use the repository (example: store a preview image)
byte[] previewData = ...;
repo.put(id, previewData);

```

The resulting JDBC connection string follows this format:

```

jdbc:h2:async:/path/to/case/previews;CACHE_SIZE=65536;DB_CLOSE_ON_EXIT=TRUE

```

## SQLite for Forensic Artefact Parsing

While H2 stores IPED's internal case data, the application ships with the **SQLite JDBC driver** (Xerial) to read forensic artefacts stored in SQLite format. This includes WhatsApp databases, Skype logs, and browser histories found on seized devices.

The SQLite driver is declared in [`iped-parsers/iped-parsers-impl/pom.xml`](https://github.com/sepinf-inc/IPED/blob/main/iped-parsers/iped-parsers-impl/pom.xml) (`org.xerial:sqlite-jdbc`). Parsers throughout the codebase open `jdbc:sqlite:` connections to analyse these third-party databases without importing them into IPED's internal H2 store.

### Accessing SQLite Evidence Files

Forensic parsers such as `LinkExtractor` in [`iped-parsers/iped-parsers-impl/src/main/java/iped/parsers/whatsapp/LinkExtractor.java`](https://github.com/sepinf-inc/IPED/blob/main/iped-parsers/iped-parsers-impl/src/main/java/iped/parsers/whatsapp/LinkExtractor.java) demonstrate how IPED connects to SQLite artefacts:

```java
// Inside a parser
String dbPath = "/path/to/WhatsApp.db";
try (Connection conn = DriverManager.getConnection("jdbc:sqlite:" + dbPath)) {
    // Run SQL queries on the artefact
    Statement st = conn.createStatement();
    ResultSet rs = st.executeQuery("SELECT name FROM sqlite_master WHERE type='table'");
    // Process results...
}

```

This approach allows IPED to query evidence files in-place without converting or migrating data to the internal database.

## Optional External Database Support

The IPED engine also includes a **PostgreSQL driver** (`postgresql:postgresql`) in its Maven dependencies. However, according to the source code analysis, this driver is present only for optional external database support scenarios. None of the core IPED classes instantiate PostgreSQL connections by default, and the primary architecture relies on the embedded H2 solution for case portability and standalone operation.

## Summary

- IPED uses an **embedded H2 database** with the `jdbc:h2:async:` protocol for storing case metadata and preview data.
- The `PreviewRepositoryManager` class manages H2 connections using **HikariCP** connection pooling.
- **SQLite JDBC** support is included for parsing forensic artefacts like WhatsApp and browser databases via `jdbc:sqlite:` connections.
- PostgreSQL drivers are available but unused in core functionality, reserved for optional external database configurations.
- Key configuration files include [`iped-engine/pom.xml`](https://github.com/sepinf-inc/IPED/blob/main/iped-engine/pom.xml) for H2 and [`iped-parsers/iped-parsers-impl/pom.xml`](https://github.com/sepinf-inc/IPED/blob/main/iped-parsers/iped-parsers-impl/pom.xml) for SQLite support.

## Frequently Asked Questions

### Does IPED use PostgreSQL as its primary database?

No. While the PostgreSQL JDBC driver is included as a Maven dependency in [`iped-engine/pom.xml`](https://github.com/sepinf-inc/IPED/blob/main/iped-engine/pom.xml), the core IPED codebase does not instantiate PostgreSQL connections by default. IPED primarily uses an embedded H2 database for case metadata storage, with PostgreSQL support available only for optional external database configurations.

### What is the JDBC URL format for IPED's embedded database?

IPED constructs H2 JDBC URLs using the `jdbc:h2:async:` prefix followed by the case directory path. A typical URL looks like `jdbc:h2:async:/path/to/case/previews;CACHE_SIZE=65536;DB_CLOSE_ON_EXIT=TRUE`. The `async:` prefix enables asynchronous file I/O operations optimized for forensic workloads.

### How does IPED parse WhatsApp databases?

IPED uses the SQLite JDBC driver (Xerial) to open read-only connections to WhatsApp's SQLite files via `jdbc:sqlite:` URLs. The `LinkExtractor` class in [`iped-parsers/iped-parsers-impl/src/main/java/iped/parsers/whatsapp/LinkExtractor.java`](https://github.com/sepinf-inc/IPED/blob/main/iped-parsers/iped-parsers-impl/src/main/java/iped/parsers/whatsapp/LinkExtractor.java) demonstrates this pattern, querying the external database without importing its contents into IPED's internal H2 store.

### Is IPED's H2 database file-based or in-memory?

IPED uses a **file-based embedded H2 database** stored within the case directory. The `PreviewRepositoryManager` configures persistent storage via the `DB_CLOSE_ON_EXIT=TRUE` parameter, ensuring case data survives application restarts while maintaining portability across forensic workstations.