database - SQLite3: Delete record without overwriting it with nullbytes -
according explanation[1] how possible recover deleted records sqlite-database, 2 things happen when delete record: area containing deleted record added free list (as free block) , "header" in content area overwritten.
the content not (or few bytes) overwritten, e.g. opening database file hex editor can still see parts of deleted record.
so check whether true or not, here’s minimal example:
sqlite3 example.db sqlite> create table 'test'(acolumn varchar(25)); sqlite> insert test values('aaaaaaaaaa'); sqlite> insert test values('bbbbbbbbbb'); sqlite> insert test values('cccccccccc'); sqlite> delete test acolumn = 'bbbbbbbbbb';
what i’m expecting – opening file hex editor – between cccc… , aaaa… there still bs (but bytes before bs or first few bs should have been overwritten). happens whole area bs has been overwritten nullbytes.
this happens larger databases, too. content area cleaned nullbytes , because of impossible recover anything.
is there option or flag have use results shown in blogpost?
i need create sqlite-databases in way, able recover deleted records (or parts of them) forensic tools.
your version of sqlite happens compiled sqlite_secure_delete enabled.
Comments
Post a Comment