Oninit forensic / Forensic Tools
Talk to an expert →

Informix® Forensic Tools: Recovery, Decompilation and Low-Level Inspection

When an Informix® instance won't start, a chunk is encrypted, or the source code is gone, Oninit®'s forensic tools get you back to your data. The toolset works below the engine: ondebug reads and decrypts pages straight from encrypted (EAR) chunk files without a running server, offline dbspace removal repairs instances that can't come online, and the Phoenix decompilers recover readable 4GL program (.4gl) and form (.per) source from compiled binaries.

Data recovery and inspection

ondebug
Reads and decrypts a single page out of a raw chunk file from an encrypted (Encryption-At-Rest) dbspace, offline and without a running engine, given the unwrapped key material and the chunk and page identifiers. The CLI also batch-decompiles forms from the command line. Library and CLI features.
Open ondebug →
Offline dbspace removal
Surgically drops a single dbspace from a rootdbs chunk file when the instance can't be brought online to do it the normal way, and the rest of the instance can start normally afterward.
Open dbspace removal →
Worked examples
Step-by-step walkthroughs for reading a page, patching a page, dropping a dbspace, and removing a page.
Open examples →

Source code recovery

Oninit Phoenix Recover
An Informix 4GL decompiler that reconstructs readable, re-compilable .4gl source from compiled .4ge programs, including functions, call graph, and control flow.
Open Phoenix Recover →
Oninit Phoenix Forms
An Informix form decompiler that recovers .per source, field definitions and attributes from compiled .frm forms.
Open Phoenix Forms →

Diagnostics

IBM® mttrace
Reference for the engine's internal MT (MultiThreaded) subsystem tracer, used to diagnose virtual-processor and thread-scheduler behavior.
Open mttrace →
Internals
Engagement-side verification harnesses, capture tooling and internal reverse-engineering notes, available to Oninit® staff.
Open Internals →

When to use these tools

  • An engine that won't start and needs a dbspace removed offline before it can come back up.
  • A chunk file that's encrypted and needs a page read or patched after a failure, with no running engine available.
  • Source code that's lost, with only the compiled 4GL program or form binary left to recover it from.
  • Migration or audit work that needs low-level, offline inspection of chunk or trace data.

What these tools are not

  • Not a keystore extractor. ondebug accepts unwrapped key material as input; obtaining those bytes is a sibling concern, kept out of this toolset.
  • Not an offline replacement for oncheck. oncheck -pP already produces plaintext pages via the running engine; ondebug is for the forensic case where the engine is unavailable, the chunk file is in hand, and the key material has been recovered through other means.
  • Not a key-rotation or remote-keystore (KMIP / AWS KMS / Azure KeyVault) integration. ondebug handles unwrapped keys only.
  • Not a live decompiler service beyond what's described above — Phoenix Recover and Phoenix Forms work from a single uploaded binary, not a running application.

Not sure which tool fits your situation? Talk to an expert.