A SQLite Recovery Method for Various Primary Key and B+tree Reorganization

Abstract

Abstract. Free blocks and free pages have tremendous forensic potential. Based on analyzing layouts of cells which have different types of keys, the mechanism of deletion and free blocks coalescing, a new recovering method with byte level accuracy is proposed. First, aiming at multiple keys' types and rewriting cases, improved methods mentioned in this study were used to calculate the values of renewed bytes. Then, coalescent free blocks were split dynamically. In addition, deleted data also was extracted from trunk leaf pages because of tree structure and the free page generating principle. The results indicate that the method is suitable for different deleted data. The recovery rate relative to free blocks is over 90% in the case of the integer key. The rate can also archive 89% even if the key is not the integer.