edma — Data Analysis and Statistics

A data analysis tool for analyzing embedded databases and byte records.

Basic Information

What is this program?

edma is a data analysis tool for analyzing record structures in embedded databases (such as SQLite, LevelDB, LMDB) and generic binary files. It dissects a file's byte array into human-readable record units, allowing you to infer schemas or search for specific field values.

It is used for analyzing IoT device logs, forensic images, and storage from embedded applications. Its core function is to find structure in data remaining as raw byte chunks without a file system.

What problem does it solve?

• ('In forensic analysis', 'when you need to find structure in residual data from deleted files', 'you can estimate record boundaries based on byte patterns to recover data.')
• ('In IoT log analysis', 'when you need to check the contents of embedded DB files', 'you can open SQLite/LevelDB files and query tables/key-values.')
• ('In debugging', 'when you're curious about an application's storage format', 'you can open storage files and analyze record structures and fields.')

Key Features

Record Dissection

Divides and displays byte arrays into record units.

• Use Case: Embedded DB / Binary analysis
• Result: Visually inspect record boundaries and field values.
• Limitations: Record boundary estimation may be inaccurate if the schema is unknown.

Schema Inference

Automatically infers field types from byte patterns and encoding.

• Use Case: Analyzing files with unknown structure.
• Result: Automatically identifies string, integer, and timestamp fields.
• Limitations: Inference results require verification.

Field Search

Searches records by specific field values.

• Use Case: Extracting target data from a large volume of records.
• Result: Supports regex, range, and pattern searches.
• Limitations: Search on large files can be slow without indexes.

SQLite & LevelDB Support

Opens and queries embedded DB files directly.

• Use Case: Analyzing storage from embedded applications.
• Result: View table and key-value structures as-is.
• Limitations: Encrypted DBs require a decryption key.

Installation and Execution

Python (pip)

Install using pip.

pip3 install edma
edma --version

cargo (source)

Install using cargo in a Rust 1.75+ environment.

cargo install edma
edma --version

Source (Python)

Install the development version from source.

git clone https://github.com/edma-dev/edma
cd edma
pip install -e .

Practical Examples

Opening a SQLite File

Opens a SQLite file and checks the list of tables.

$ edma open app.db

[edma] SQLite 3 file detected (12 tables)
  users        (1024 rows, 5 columns)
  orders       (8471 rows, 7 columns)
  sessions     (2048 rows, 4 columns)

$ edma query app.db 'SELECT id, email FROM users LIMIT 3'
  1  alice@example.com
  2  bob@example.com
  3  carol@example.com

Analyzing Byte Records

Estimates and analyzes the record structure in a binary file.

$ edma analyze firmware.bin --record-size 64

[edma] firmware.bin — 1.2 MB, record size 64 bytes
[edma] estimated 19,200 records
[edma] fields: [0..15] string, [16..19] uint32, [20..27] timestamp, [28..63] payload
[edma] sample record #100:
  string:  "sensor-a3"
  uint32:  42
  timestamp: 2026-10-17T08:23:01Z

Searching Records

Searches for records by specific values.

$ edma search firmware.bin --field 'sensor-a3' --limit 5

[edma] 5 matches found
  #100  sensor-a3  val=42  ts=2026-10-17T08:23:01Z
  #256  sensor-a3  val=38  ts=2026-10-17T08:23:05Z
  ...

Advantages and Limitations

Advantages

• Analyzes embedded DBs like SQLite, LevelDB, and LMDB without separate runtimes.
• Automatically infers record structures from binary files.
• Extracts target data from large volumes of records using regex and range searches.
• Supports both Python and Rust installation methods — suitable for both forensics and development.

Considerations Before Use

• Record boundary estimation for files with unknown schemas may be inaccurate.
• Cannot analyze encrypted embedded DBs without a decryption key.
• As an early version (0.7.x), support for some DB formats may be limited.

Comparison with Similar Programs

Official Resources and Further Learning

• Official Website — https://edma.tools/
• Official Documentation / Knowledge Base — https://edma.tools/docs/
• Official Download — https://edma.tools/downloads
• Release Notes — https://edma.tools/changelog
• Source / Development Resources — https://github.com/chungquantin/edma

Version and supported environment information is based on values verified on the official site as of 2026-10-18. Installation commands may vary depending on the distribution and version you use, so please refer to the official installation documentation as well.

Actual Execution Screen

The screen below is a synthetic example created to help understand the usage flow (not an actual execution result). The screen is a synthetic example and is not an actual execution result.

!Example of edma SQLite and byte record analysis: app.db with 12 tables, firmware.bin with record estimation

Live Production Server

Source (HTML): https://games.aidebatehub.com/programs/apps/data/edma.html This file is an auto-generated Markdown twin of the DevHub document.