Chat data recovery method based on SQLite full-text index

Abstract

The invention discloses a chat data recovery method based on SQLite full-text index. The chat data recovery method is characterized by comprising the following steps: S100, searching and obtaining a full-text index database file of an SQLite database; s200, searching and obtaining an auxiliary file of a full-text index in the full-text index database file by adopting an SQLite database tool; s300, obtaining a plurality of block fields in the auxiliary file of the full-text index; s400, decoding the plurality of obtained block fields, and generating plaintext contents corresponding to the plurality of block fields respectively; s500, filtering the plaintext content and sequentially extracting data of which the item number term is equal to 0 line by line so as to obtain an index segmented word, and recording a serial number id and a position serial number nPos where the index segmented word appears; and S600, assembling and generating a recovered chat record.

Description

Technical Field

[0001] The invention belongs to the field of data recovery and electronic data forensics, and relates to a chat data recovery method based on SQLite full-text indexing. Background Art

[0002] Modern chat applications (such as WeChat, WhatsApp, Telegram, Signal, etc.) generally use SQLite as a local database storage solution, mainly due to its lightweight, high efficiency, cross-platform compatibility and embedded features.

[0003] SQLite plays a core data storage role in chat apps. Through reasonable database and table design, encryption, indexing, and synchronization strategies, it supports key functions such as message storage, search, and multi-terminal synchronization.

[0004] Chat data is stored in a SQLite database, with specific chat records typically stored in database tables. Deleting records erases them from these tables. Therefore, after deleting chat records, recovering them through conventional database table queries is incomplete, making some deleted chat records unrecoverable. Summary of the Invention

[0005] The present invention addresses the shortcomings of existing technologies by deeply mining SQLite's full-text index to recover all chat data. SQLite's full-text index breaks down all text stored in the database into individual characters, which serve as index terms. By sorting and assembling these index terms into complete records, the recovered data includes deleted data, ensuring that deleted records are not missed. The provided method includes the following steps:

[0006] S100: Find and obtain the full-text index database file FTS5IndexMicroMsg.db of the SQLite database;

[0007] S200: Using the SQLite database tool, searching and obtaining the full-text index database table FTS5IndexMessage_data in the full-text index database file FTS5IndexMicroMsg.db;

[0008] S300: Acquire multiple block fields in the full-text index database table FTS5IndexMessage_data;

[0009] S400: Decode the obtained multiple block fields and generate the plaintext content corresponding to each of the multiple block fields, which includes the item number term, the record number id, and the position number nPos where the index word appears. The block field is used to store index position related information and its data type is blob;

[0010] S500: Filter the plaintext content and sequentially extract data with entry number term equal to 0 line by line to obtain the index word, record number id, and position number nPos where the index word appears. The index word is the character that appears after the entry number term equals 0.

[0011] S600: Assembling and generating restored chat records, including the following steps:

[0012] Summarize the obtained index word, record number id, and position number nPos where the index word appears;

[0013] Group the index participles and the position number nPos of the index participles with the same record number id separately;

[0014] Each group is sorted in order of record number id;

[0015] Each group determines the position of the index word in the chat record according to the position number nPos of the index word;

[0016] According to the record sequence number id and the position where the determined index segmentation word appears in the chat record, the chat record is assembled and restored in sequence.

[0017] Preferably, step S400 includes the following steps:

[0018] According to the record sequence number id and block fields, the SQL statement is used to perform decoding. The SQL statement is: select id,fts5_decode(id,block)from FTS5IndexMessage_data;

[0019] Based on each record number id, the decoding result is generated as a row record including the record number id and the decoding result.

[0020] Preferably, the number following the entry number term is the index level number, and the characters following the index level number are index participles.

[0021] Preferably, the step of filtering the plain text content in step S500 includes: removing row records whose record sequence number id is less than 10.

[0022] The beneficial effects of the present invention are: the method is simple, no hardware cost is required, and the chat record is restored completely. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is the overall flow chart of the present invention;

[0024] Figure 2 This is an example diagram of a row record of a decoding result according to an embodiment of the present invention;

[0025] Figure 3 This is an example diagram of the plaintext content after decoding in an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The present invention will be further described below with reference to the accompanying drawings and examples.

[0027] like Figure 1 As shown, the method of the present invention comprises the following steps:

[0028] S100: Find and obtain the full-text index database file FTS5IndexMicroMsg.db of the SQLite database;

[0029] S200: Using the SQLite database tool, searching and obtaining the full-text index database table FTS5IndexMessage_data in the full-text index database file FTS5IndexMicroMsg.db;

[0030] S300: Acquire multiple block fields in the full-text index database table FTS5IndexMessage_data;

[0031] S400: Decode the obtained multiple block fields and generate the plaintext content corresponding to each of the multiple block fields, which includes the item number term, the record number id, and the position number nPos where the index word appears. The block field is used to store index position related information and its data type is blob;

[0032] Step S400 includes the following steps:

[0033] According to the record sequence number id and block fields, the SQL statement is used to perform decoding. The SQL statement is: select id,fts5_decode(id,block)from FTS5IndexMessage_data;

[0034] Based on each record number id, the decoding result is generated as a row record including the record number id and the decoding result.

[0035] Figure 2 FIG. 4 shows an example diagram of a row record of a decoding result in an embodiment of the present invention. Figure 2 As shown, the first column of this row record is the record serial number id, and the second column is the decoding result.

[0036] S500: Filter the plaintext content and sequentially extract line by line the data where the entry number term is equal to 0 to obtain the index segmentation words, the record serial number id, and the position serial number nPos where the index segmentation words appear. Among them, the index segmentation words are the characters that appear after the entry number term is equal to 0;

[0037] The number following the entry number term is the level of the index, and the characters following the level of the index are the index segmentation words.

[0038] The steps of filtering the plaintext content include: removing the row records where the record serial number id is less than 10.

[0039] Figure 3 An example diagram of the decoded plaintext content in the embodiment of the present invention is shown. As Figure 3 shown by the underlined part below, for example, in "term = 0 false", 0 is the level of the index, and the "false" character following 0 is the index segmentation word. The current "false" character is one of the characters in the chat record that we need to restore.

[0040] S600: Assemble and generate the restored chat record, including the following steps:

[0041] Summarize the obtained index segmentation words, record serial number id, and position serial number nPos where the index segmentation words appear;

[0042] Group the index segmentation words and the position serial number nPos where the index segmentation words appear for each same record serial number id respectively;

[0043] Sort each group in the order of the record serial number id;

[0044] For each group, determine the position where the index segmentation word appears in the chat record according to the position serial number nPos where the index segmentation word appears;

[0045] Assemble and restore the chat record sequentially according to the record serial number id and the position where the index segmentation word appears in the chat record.

[0046] Specifically, as Figure 3 shown by the underlined part below, taking "term = 0 false id = 62 nPos = 18 id = 190 nPos = 2512" as an example, the data of this term = 0 indicates that the "false" character appears at the 1st and 8th character positions in id = 62, and appears at the 2nd, 5th, and 12th character positions in id = 190 respectively. And so on, until all the index segmentation words are assembled, and the restoration of the chat record is completed.

[0047] It should be understood that the record ID, also known as the document ID, corresponds to the row record in the master database, such as the msgId of WeChat. Its function is to link to the original record in the master database.

[0048] For example, in WeChat, the id may correspond to the msgId field in the message table of MicroMsg.db. The characteristic is that multiple terms in the same document will share the same id. And we can quickly locate the complete message content in the main database through the id

[0049] The method provided by the present invention solves the technical problem that there is no chat data recovery method based on SQLite full-text index in the prior art, with low cost, simple method and complete recovery.

[0050] It should be understood that the present invention is not limited to the above examples. Those skilled in the art can make improvements or changes based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A chat data recovery method based on SQLite full-text indexing, characterized in that The following steps are involved: S100: Find and obtain the full-text index database file FTS5IndexMicroMsg.db of the SQLite database; S200: Using the SQLite database tool, searching and obtaining the full-text index database table FTS5IndexMessage_data in the full-text index database file FTS5IndexMicroMsg.db; S300: Acquire multiple block fields in the full-text index database table FTS5IndexMessage_data; S400: Decode the obtained multiple block fields and generate the plaintext content corresponding to each of the multiple block fields, which includes the item number term, the record number id, and the position number nPos where the index word appears. The block field is used to store index position related information and its data type is blob; S500: Filter the plaintext content and sequentially extract data with entry number term equal to 0 line by line to obtain the index word, record number id, and position number nPos where the index word appears. The index word is the character that appears after the entry number term equals 0. S600: Assembling and generating restored chat records, including the following steps: Summarize the obtained index word, record number id, and position number nPos where the index word appears; Group the index participles and the position number nPos of the index participles with the same record number id separately; Each group is sorted in order of record number id; Each group determines the position of the index word in the chat record according to the position number nPos of the index word; According to the record sequence number id and the position where the determined index segmentation word appears in the chat record, the chat record is assembled and restored in sequence.

2. A chat data recovery method based on SQLite full-text indexing according to claim 1, characterized in that, Step S400 includes the following steps: According to the record sequence number id and block fields, the SQL statement is used to perform decoding. The SQL statement is: select id,fts5_decode(id,block)from FTS5IndexMessage_data; Based on each record number id, the decoding result is generated as a row record including the record number id and the decoding result.

3. A chat data recovery method based on SQLite full-text indexing according to claim 1, characterized in that, The number following the term is the index level, and the characters following the index level are the index terms.

4. A chat data recovery method based on SQLite full-text indexing according to claim 1, characterized in that, The step of filtering the plain text content in step S500 includes: removing row records with record sequence numbers id less than 10.

Images