Recovering SQLite data from fragmented flash pages
- 49 Downloads
As a small-sized database engine, SQLite is widely used in embedded devices, such as mobile phones and PDAs. Large amounts of sensitive personal data are stored in SQLite. Any unintentional data deletion or unexpected device damage can cause considerable loss to the owners of the data. Therefore, in these cases, it is necessary to be able to recover and extract SQLite data records from the flash memory of portable devices. However, most existing SQLite recovery studies take the database file as the research subject, while it is not possible to acquire an intact database file when the flash memory controller is damaged. This paper presents a new method to recover SQLite data records from fragmented flash pages. Instead of investigating the whole *.db file or the journal file, the suggested method focuses on the analysis of B-Tree leaf page structure, which is the basic storage unit, to locate and extract existing and deleted data records based on the structures of the page header and cells in the leaf page, and then uses the SQLite_master structure to translate hex data records into meaningful SQLite tables. The experimental results show that this new method is effective regardless of which file system is used.
KeywordsData recovery SQLite database Fragmented flash pages B-Tree leaf page SQLite_master
This work is supported by the National Natural Science Foundation of China (No. 61802210) and the Young Scholar Program of He’nan Education Department of China (No. 2014GGJS-111) and the key scientific research Program of He’nan Education Department of China (No. 17A520048).
- 6.Marcel B, Martien D (2007) Forensic data recovery from flash memory. Small Scale Digit Device Forensic J 1(1):1–17Google Scholar
- 9.Darren Q, Mohammed A (2011) Forensic analysis of the android file system YAFFS2. In: Proceedings of the 9th Australian Digital Forensics Conference, Edith Cowan University, Perth Western Australia, pp 99–109Google Scholar
- 11.Sun Z, Zhang Q, Li Y, Tan Y-A (2018) DPPDL: a dynamic partial-parallel data layout for green video surveillance storage. IEEE transactions on circuits and systems for video. Technology 28(1):193–205Google Scholar
- 26.Liu XP, Fu X, Sun G (2016) Recovery of deleted record for SQLite3 database. In: International conference on intelligent human-machine system & cybernetics. IEEEXplore, pp 183–187Google Scholar
- 30.DFRWS. DFRWS-2011-challenge (2011) http://www.dfrws.org/2011/challenge/index.shtml. Accessed 5 May 2013