Title :
Recovery of SQLite Data Using Expired Indexes
Author :
Ramisch, Felix ; Rieger, Martin
Author_Institution :
Fac. Comput. Sci., Albstadt-Sigmaringen Univ., Albstadt, Germany
Abstract :
SQLite databases have tremendous forensic potential. In addition to active data, expired data remain in the database file, if the option secure delete is not applied. Tests of available forensic tools show, that the indexes were not considered, although they may complete the recovery of the table structures. Algorithms for their recovery and combination with each other or with table data are worked out. A new tool, SQLite Index Recovery, was developed for this study. The use with test data and data of Apple Mail shows, that the recovery of indexes is possible and enriches the recovery of ordinary table data.
Keywords :
database indexing; digital forensics; relational databases; Apple Mail data; SQLite data recovery; SQLite databases; SQLite index recovery; active data; database file; expired data; forensic tools; table data; table structure recovery; test data; File systems; Forensics; Indexes; Metadata; Oxygen; Postal services; Apple Mail; SQLite; database; expired data; forensic tool; free block; index; recovery;
Conference_Titel :
IT Security Incident Management & IT Forensics (IMF), 2015 Ninth International Conference on
Conference_Location :
Magdeburg
Print_ISBN :
978-1-4799-9902-6
DOI :
10.1109/IMF.2015.11
