Obviously the guy knew that he's onto something shady. Why else would someone name an sqlite database .png2?

Can't give you any legal advice though. I reckon you should go after what others recommend here.