database - SQLite3: Delete record without overwriting it with nullbytes -


according explanation[1] how possible recover deleted records sqlite-database, 2 things happen when delete record: area containing deleted record added free list (as free block) , "header" in content area overwritten.

the content not (or few bytes) overwritten, e.g. opening database file hex editor can still see parts of deleted record.

so check whether true or not, here’s minimal example:

sqlite3 example.db  sqlite> create table 'test'(acolumn varchar(25)); sqlite> insert test values('aaaaaaaaaa'); sqlite> insert test values('bbbbbbbbbb'); sqlite> insert test values('cccccccccc'); sqlite> delete test acolumn = 'bbbbbbbbbb'; 

what i’m expecting – opening file hex editor – between cccc… , aaaa… there still bs (but bytes before bs or first few bs should have been overwritten). happens whole area bs has been overwritten nullbytes.

this happens larger databases, too. content area cleaned nullbytes , because of impossible recover anything.

is there option or flag have use results shown in blogpost?

i need create sqlite-databases in way, able recover deleted records (or parts of them) forensic tools.

[1]http://sandersonforensics.com/forum/content.php?222-recovering-deleted-records-from-an-sqlite-database

your version of sqlite happens compiled sqlite_secure_delete enabled.


Comments

Popular posts from this blog

magento2 - Magento 2 admin grid add filter to collection -

Android volley - avoid multiple requests of the same kind to the server? -

Combining PHP Registration and Login into one class with multiple functions in one PHP file -