Analysis databases
An analysis database saves recovered project information so that you can return to an investigation without starting from the binary each time.
Use File > Data Base to save or open analysis data. The compressed VDD database stores recovered structure, forms and resources, analyst-assigned names, method metadata and cached listings for later review. Saving fully processed output is useful when initial analysis of a large application takes a long time.
You can also open a saved database through the file-opening workflow, drag it onto the window or pass its path on the command line. Keep the corresponding original binary alongside the database when transferring investigation material between workstations.
Reviewing a database without the executable
Previously cached native code remains available when the original executable is absent. Saved form resources and recovered structure can also be inspected. A procedure that was not decoded before saving still needs the matching original image; DE Decompiler does not decode it against a missing or changed executable.
Review or export the available cached material, and check any messages identifying undecoded procedures. For a portable investigation snapshot, process the required procedures before saving and keep the exact input binary with the database whenever possible.
Saving and compatibility
Database saving supports cancellation and replaces an existing VDD only after a complete write. If an individual procedure cannot be decoded, the database can still retain the other analysis data; review the warnings reported after saving.
Newer databases can contain extended model and resource data. An older build may display only a compatibility subset. Use the current DE Decompiler build to inspect all saved data.
What to preserve
- The analysis database and the exact binary it describes.
- The DE Decompiler build and relevant processing settings.
- Any separate notes, analyst-assigned names and exported material used in the investigation.
A database is an analysis artifact. It is distinct from the recovered source files and does not replace the original executable as the source of addresses and bytes.
Checking a saved analysis
After opening a database on another workstation, inspect a known unit, method and form. When comparing results from different decompiler builds, retain the earlier database and record which build produced each result.