ATTENTION: The new home of the Digital Forensics Wiki is at https://forensicswiki.xyz/. Yeah, it's a silly name, but it was cheap.
This wiki will be going offline permanently in the near future. An exact date will be announced soon. Thank you for being a part of this community.
If you wish to work on the new forensicswiki, please join the Google Group forensicswiki-reborn
SQLite database format
SQLite databases are used by many programs including several forensics tools, e.g. Autopsy 3. SQLite 3 is current and older SQLite packages cannot use sqlite3 databases so use sqlite3 tools.
SQLite version 3 uses a page-based storage where the pages are used for various types of data e.g. there are:
- lock-byte pages
- freelist pages
- freelist trunk pages
- freelist leaf pages
- B-tree pages
- table B-tree interior pages
- table B-tree leaf pages
- index B-tree interior pages
- index B-tree leaf pages
- payload overflow pages
- pointer map pages
Write-Ahead Log (WAL)
The default method by which SQLite implements atomic commit and rollback is a rollback journal. In version 3.7.0 a "Write-Ahead Log" option was added.
Web Browser Data
- The SQLite Database File Format, by the SQLite project
- Write-Ahead Logging, by the SQLite project
- Recovering Data from Deleted SQLite Records: Redux, by John Lehr, September 13, 2013