A recovery method of deleted record for SQLite database

Authors:
Sangjun Jeon;Jewan Bang;Keunduck Byun;Sangjin Lee
Affiliations:
Digital Forensic Research Center, Korea University, Seoul, South Korea;Digital Forensic Research Center, Korea University, Seoul, South Korea;Digital Forensic Research Center, Korea University, Seoul, South Korea;Digital Forensic Research Center, Korea University, Seoul, South Korea
Venue:
Personal and Ubiquitous Computing
Year:
2012

Citing 2
Cited 1

Principles of transaction-oriented database recovery

ACM Computing Surveys (CSUR)
Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records

Digital Investigation: The International Journal of Digital Forensics & Incident Response

A recovery approach for SQLite history recorders from YAFFS2

ICT-EurAsia'13 Proceedings of the 2013 international conference on Information and Communication Technology

Quantified Score

Hi-index	0.00

Visualization

Abstract

SQLite is a small-sized database engine largely used in embedded devices and local application software. The availability of portable devices, such as smartphones, has been extended over the recent years and has contributed to growing adaptation of SQLite. This implies a high likelihood of digital evidences acquired during forensic investigations to include SQLite database files. Where intentional deletion of sensitive data can be made by a suspect, forensic investigators need to recover deleted records in SQLite at the best possible. This study analyzes data management rules used by SQLite and the structure of deleted data in the system and in turn suggests a recovery tool of deleted data. Further, the study examines major SQLite suited software as it validates feasible possibility of deleted data recovery.