A sqlite data recovery method suitable for merging non-integer primary keys and free blocks

Abstract

The invention provides an SQLite data recovery method applicable to merging of non-integral primary keys and free blocks and relates to the field of computer forensics. The method includes the steps of 1), starting from a root page and a file header to search all the free blocks and free pages; 2), analyzing difference of cell layout of integral primary keys and the non-integral primary keys as well as difference of meanings of bytes, temporarily assuming each free block contains one cell, calculating information of types covered, analyzing the type information and a data field and performing data recovery; 3), for the free blocks cannot pass the step 2), believing that each of the free blocks contains multiple cell, pre-estimating length of the cells stored in the free blocks is from 4 to free block length on the basis of splitting and verifying, and judging pre-estimated values with a single free block extraction module; 4), in response to decreasing of the free blocks due to B+tree reorganization, extracting the data from the free pages collected in the step 1). With the method, the data deleted can be easily recovered from SQLite3 database files, and the data is provided for follow-up electronic forensics work.

Description

Technical field [0001] The invention relates to the field of computer forensics, and mainly relates to data recovery of SQLite databases, and in particular to a database recovery method based on SQLite file structure and deletion and reorganization mechanisms. Background technique [0002] According to the Trend Force research report, in the third quarter of 2016 alone, the number of smartphones produced reached 350 million units and maintained a growth trend. In electronic forensics, smart machine forensics is very important, and data extraction is the basis for forensic work. A large amount of user information such as short messages, browsing records, and address book are stored in SQLite. How to extract the deleted data is of great significance to forensics. [0003] Since 1983, many scholars have conducted research on the recovery of deleted data in SQLite. The existing research mainly focuses on four aspects. First, from the perspective of auxiliary files, transaction files...

AI Technical Summary

Problems solved by technology

A method is proposed to make up for the lack of parsing ability of the existing methods for non-primary key data. It also takes into account the situation of splitting free blocks to improve the recovery rate, and comprehensively considers the phenomenon of increasing the number of free pages that affects the recovery rate. Recovery rate method for SQLite deleted data

Images