|
|
Article DetailsThis article covers the WindowsMail.MSMessageStore database used by Windows Mail. This article may serve as an aid to forensic examiners or data recovery technicians.
A short guide covering how to quickly gather all file signatures (file headers) from all files within a case for review and/or research purposes. This article will use the tools Header Grab Advanced, part of the Simple Carver Suite. This article may serve as an aid to forensic examiners or data recovery technicians.
A short guide covering how to quickly view and export search results from Winhex POS files to CSV format. This article may serve as an aid to forensic examiners or data recovery technicians.
A short guide covering how to quickly search for and detect any hidden worksheets present within a Microsoft Excel Workbook (xls and xlsx). This article will use the tools XLS Worksheet Detect Free and commercial versions, part of the Simple Carver Suite. This article may serve as an aid to forensic examiners or data recovery technicians.
A short guide covering how to batch preview URL files used to store favorites information in Internet Explorer. This article will use the tool URL Previewer, part of the Simple Carver Suite. This article may serve as an aid to forensic examiners or data recovery technicians.
- Active Links: 10
- Pending Links: 3
- Todays Links: 0
- Total Articles: 16
- Total Categories: 4
- Sub Categories: 0
SQLite 3 database files - Identifying Deleted Data |
| Date Added: June 07, 2009 07:19:46 PM |
| Author: admin |
| Category: Documents |
|
SQLite 3 database format, a self contained relational database format used in a growing number of applications ranging from Internet Browsers to mobile phone backup software. Visit www.sqlite.org for more information. A sample database was created with a table ‘addressbook’, three records were inserted into the table listed below. One record was deleted, SQLite3 was closed and a backup of the database was performed. A different tool was used to list the available records after deletion.
Opening the same file in a hex editor the deleted record can be seen.
Recovery depends on the database complexity and/or host software (if the Vacuum command is issued on this database then the deleted data will be lost).
More information on SQLite3 and database commands: http://www.sqlite.org |
