Practical Mobile Forensics - Third Edition

Recovering deleted SQLite records

SQLite databases store the deleted records within the database itself, so it is possible to recover deleted data, such as contacts, SMS, calendar, notes, email, voicemail, and more by parsing the corresponding SQLite database. If a SQLite database is vacuumed or defragmented, the likelihood of recovering the deleted data is minimal. The amount of cleanup that these databases require relies heavily on the iOS version, the device, and the user's settings on the device.

A SQLite database file comprises one or more fixed size pages, which are used just once. SQLite uses a b-tree layout of pages to store indices and table content. Detailed information on the b-tree layout can be found at https://github.com/NotionalLabs/SQLiteZer/blob/master/_resources/Sqlite_carving_extractAndroidData.pdf ...