Making the Invisible Visible – Techniques for Recovering Deleted SQLite Data Records

Dirk Pawlaszczyk and Christian Hummert
Additional contact information
Dirk Pawlaszczyk: Hochschule Mittweida - University of Applied Sciences, Germany
Christian Hummert: Central Office for Information Technology in the Security Sector (ZITiS), Germany

International Journal of Cyber Forensics and Advanced Threat Investigations, 2020, vol. 1, issue 1-3, 27-41

Abstract: Forensic analysis and evidence collection for web browser activity is a recurring problem in digital investigation. It is not unusual for a suspect to cover his traces. Accordingly, the recovery of previously deleted data such as web cookies and browser history are important. Fortunately, many browsers and thousands of apps used the same database system to store their data: SQLite. Reason enough to take a closer look at this product. In this article, we follow the question of how deleted content can be made visible again in an SQLite-database. For this purpose, the technical background of the problem will be examined first. Techniques are presented with which it is possible to carve and recover deleted data records from a database on a binary level. A novel software solution called FQLite is presented that implements the proposed algorithms. The search quality, as well as the performance of the program, is tested using the standard forensic corpus. The results of a performance study are discussed, as well. The article ends with a summary and identifies further research questions.

Keywords: Digital Forensics; Database Investigations; SQLite; FQLite; Data Recovery; Digital Traces; Free-Page List (search for similar items in EconPapers)
Date: 2020
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
https://conceptechint.net/index.php/CFATI/article/download/17/6 (application/pdf)
https://conceptechint.net/index.php/CFATI/article/view/17 (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:aox:rcfati:v:1:y:2020:i:1-3:p:27-41

DOI: 10.46386/ijcfati.v1i1-3.17

Access Statistics for this article

International Journal of Cyber Forensics and Advanced Threat Investigations is currently edited by Professor John William Walker

More articles in International Journal of Cyber Forensics and Advanced Threat Investigations from Concept Tech Publishing
Bibliographic data for series maintained by Mira Leonko ().