Skip to main content
SpringerLink
Log in

A recovery method of deleted record for SQLite database

  • Original Article
  • Published:
Personal and Ubiquitous Computing Aims and scope Submit manuscript

Abstract

SQLite is a small-sized database engine largely used in embedded devices and local application software. The availability of portable devices, such as smartphones, has been extended over the recent years and has contributed to growing adaptation of SQLite. This implies a high likelihood of digital evidences acquired during forensic investigations to include SQLite database files. Where intentional deletion of sensitive data can be made by a suspect, forensic investigators need to recover deleted records in SQLite at the best possible. This study analyzes data management rules used by SQLite and the structure of deleted data in the system and in turn suggests a recovery tool of deleted data. Further, the study examines major SQLite suited software as it validates feasible possibility of deleted data recovery.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7
Fig. 8
Fig. 9
Fig. 10
Fig. 11
Fig. 12
Fig. 13

Similar content being viewed by others

References

  1. Haerder T (1983) Principles of transaction-oriented database recovery, ACM Comput Surv 15:287–317

  2. Pereira MT (2004) Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records, Digit Investig 5:93–103

    Google Scholar 

  3. Newman C (2004) “SQLite” MacmillanComputerPub

  4. SQLite (2004) SQL as understood by SQLite, http://www.sqlite.org/lang.html

  5. SQLite (2004) Well-known users of SQLite, http://www.sqlite.org/famous.html

  6. SQLite (2004) iPhone OS data management, http://developer.apple.com/technologies/iphone/data-management.html

  7. SQLite (2004) Datatypes in SQLite version 3, http://www.sqlite.org/datatype3.html

Download references

Acknowledgments

“This research was supported by the MKE (The Ministry of Knowledge Economy), Korea, under the “ITRC” support program supervised by the NIPA (National IT Industry Promotion Agency)” (NIPA-2010-C1090-1001-0004).

Author information

Authors and Affiliations

  1. Digital Forensic Research Center, Korea University, Seoul, South Korea

    Sangjun Jeon, Jewan Bang, Keunduck Byun & Sangjin Lee

Authors
  1. Sangjun Jeon
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Jewan Bang
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Keunduck Byun
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Sangjin Lee
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Sangjin Lee.

Rights and permissions

Reprints and permissions

About this article

Cite this article

Jeon, S., Bang, J., Byun, K. et al. A recovery method of deleted record for SQLite database. Pers Ubiquit Comput 16, 707–715 (2012). https://doi.org/10.1007/s00779-011-0428-7

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s00779-011-0428-7

Keywords

Search

Navigation