Practical Mobile Forensics - Fourth Edition

Recovering deleted files by parsing SQLite files

Android uses SQLite files to store most data. Data related to text messages, emails, and certain app data is stored in SQLite files. SQLite databases can store deleted data within the database itself. Files marked for deletion by the user no longer appear in the active SQLite database files. Therefore, it is possible to recover the deleted data, such as text messages and contacts. There are two areas within a SQLite page that can contain deleted data—unallocated blocks and free blocks.

Most of the commercial tools that recover deleted data scan the unallocated blocks and free blocks of the SQLite pages. Parsing the deleted data can be done using the available forensic tools, such as Oxygen ...