Recovering deleted SQLite records

In addition to the recovering techniques covered in Chapter 3, Data Acquisition from iOS Devices, you can also recover the deleted records from a SQLite database. SQLite databases store the deleted records within the database itself. So, it is possible to recover the deleted data such as contacts, SMS, calendar, notes, e-mails and voicemails, and more by parsing the corresponding SQLite database. If a SQLite database is vacuumed or defragmented, the likelihood of recovering the deleted data is minimal. The amount of cleanup these databases require heavily relies on the iOS version, the device, and the user's settings on the device.

A SQLite database file comprises one or more fixed size pages, which are used just once. SQLite uses a b-tree layout of pages to store indices and table content. Detailed information on the b-tree layout is explained at http://sandbox.dfrws.org/2011/fox-it/DFRWS2011_results/Report/Sqlite_carving_extractAndroidData.pdf.

To carve...