A Novel Forensic Methodology for SQLite Database Carving

Abstract

The cellphones utilize SQLite to store communication as well as other data records. It is a type of small database software that is commonly found in embedded systems and application softwares. In recent years, there has been an increase in the availability of portable devices like smartphones, contributing to the expanding adoption of SQLite. This indicates that the probability of finding SQLite database files in digital evidences is very high. The forensic investigators could get treasures of evidential artifacts from the SQLite database file. This paper explores the SQLite database format and structure of lost data from an Android phone and proposes a novel methodology for recovering deleted data from unallocated space, freelist and freeblocks in SQLite database files. The proposed methodology is found very effective for recovering deleted data from SQLite database files.