December 2018
Beginner to intermediate
328 pages
8h 29m
English
Most of the application data in Android is stored in SQLite databases. Data related to text messages, emails, and most app data is stored in SQLite databases. Such databases can store deleted data within the database itself. Records marked for deletion by the user no longer appear in the active SQLite database files. Therefore, it is possible to recover the deleted data, such as text messages, contacts, and more, by analyzing these SQLite files. There are two areas within an SQLite page that can contain deleted data: unallocated blocks and free blocks. Most of the commercial forensic tools that recover deleted data scan the unallocated blocks and free blocks of the SQLite pages. Parsing the ...
Read now
Unlock full access