A recovery approach for SQLite history recorders from YAFFS2

Authors:
Beibei Wu;Ming Xu;Haiping Zhang;Jian Xu;Yizhi Ren;Ning Zheng
Affiliations:
College of Computer, Hangzhou Dianzi University, Hangzhou, China;College of Computer, Hangzhou Dianzi University, Hangzhou, China;College of Computer, Hangzhou Dianzi University, Hangzhou, China;College of Computer, Hangzhou Dianzi University, Hangzhou, China;College of Computer, Hangzhou Dianzi University, Hangzhou, China;College of Computer, Hangzhou Dianzi University, Hangzhou, China
Venue:
ICT-EurAsia'13 Proceedings of the 2013 international conference on Information and Communication Technology
Year:
2013

Citing 4
Cited 0

Principles of transaction-oriented database recovery

ACM Computing Surveys (CSUR)
Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records

Digital Investigation: The International Journal of Digital Forensics & Incident Response
Forensic imaging of embedded systems using JTAG (boundary-scan)

Digital Investigation: The International Journal of Digital Forensics & Incident Response
A recovery method of deleted record for SQLite database

Personal and Ubiquitous Computing

Quantified Score

Hi-index	0.00

Visualization

Abstract

Nowadays, forensic on flash memories has drawn much attention. In this paper, a recovery method for SQLite database history records (I.e. updated and deleted records) form YAFFS2 is proposed. Based on the out-of-place-write strategies in NAND flash memory required by YAFFS2, the SQLite history recorders can be recovered and ordered into timeline by their timestamps. The experiment results show that the proposed method can recover the updated or deleted records correctly. Our method can help investigators to find the significant information about user actions in Android smart phones by these history recorders, although they seem to have been disappeared or deleted.