Recovering deleted records from an SQLite database

Re:Recovering deleted records from an SQLite database by mox1 on Monday April 06, 2015 @09:52AM (#9328060)

Incase anyone is wondering why this is useful, lots and lots of android and iOS applications (including system apps , OS functionality) use SQLite for storing all kinds of things.

Mobile devices forensics quickly turns into "What data is in this SQLite table?"

[ Parent | on HN ]

Re:Recovering deleted records from an SQLite database by shabble on Monday April 06, 2015 @10:22AM (#9328197)

Doesn't (Desktop) Firefox use it for history and bookmarks and various things as well[1]?

I wonder if 'delete my history' GUI action actually removes the file (securely) or just deletes entries from it, exposing it to this sort of recovery?

[1] The file location and sample query against places.sqlite from http://www.forensicswiki.org/wiki/Mozilla_Firefox#History works for me on OSX 10.9/FF37

[ Parent | on HN ]

Re:Recovering deleted records from an SQLite database by asutherland on Monday April 06, 2015 @04:06PM (#9330411)

Firefox's Places subsystem does use SQLite. Firefox's built-in SQLite implementation is compiled with the SQLITE_SECURE_DELETE mechanism referenced elsewhere in this thread (https://dxr.mozilla.org/mozilla-central/source/db/sqlite3/sr...) and a configure check is performed when Firefox is built with system SQLite (https://dxr.mozilla.org/mozilla-central/source/configure.in#...).

Additionally, there's a unit test that verifies that the feature is really working at https://dxr.mozilla.org/mozilla-central/source/storage/test/... that checks that a string shows up in the database and then disappears from the database when the row is removed from the database.

[ Parent | on HN ]