• DFIR Resources
  • Making the Invisible Visible – Techniques for Recovering Deleted SQLite Data Records

Making the Invisible Visible – Techniques for Recovering Deleted SQLite Data Records

Hot
119 1

DFIR Resources

Research and Documentation
White Papers & Journals
Analysis - Devices & OSs
Databases
Forensic analysis and evidence collection for web browser activity is a recurring problem in digital investigation. It is not unusual for a suspect to cover his traces. Accordingly, the recovery of previously deleted data such as web cookies and browser history are important. Fortunately, many browsers and thousands of apps used the same database system to store their data: SQLite. Reason enough to take a closer look at this product. In this article, we follow the question of how deleted content can be made visible again in an SQLite-database. For this purpose, the technical background of the problem will be examined first. Techniques are presented with which it is possible to carve and recover deleted data records from a database on a binary level. A novel software solution called FQLite is presented that implements the proposed algorithms. The search quality, as well as the performance of the program, is tested using the standard forensic corpus. The results of a performance study are discussed, as well. The article ends with a summary and identifies further research questions.

Attachments

  • File Description
    File Size
    File Type
    Downloads
  • Making the Invisible Visible – Techniques for Recovering Deleted SQLite Data Records
    3 MB

User comments

There are no user comments for this listing.
Already have an account? or Create an account