CN108052417B

CN108052417B - SQLite data deletion recovery method

Info

Publication number: CN108052417B
Application number: CN201711387853.5A
Authority: CN
Inventors: 吴松洋; 熊雄; 张鹤; 张厚宝; 朱明哲
Original assignee: Third Research Institute of the Ministry of Public Security
Current assignee: Third Research Institute of the Ministry of Public Security
Priority date: 2017-12-20
Filing date: 2017-12-20
Publication date: 2021-10-01
Anticipated expiration: 2037-12-20
Also published as: CN108052417A

Abstract

The invention discloses an SQLite data deletion recovery method, which utilizes table structure information to construct and record a segmented characteristic character string; then according to a reverse order mode, constructing a character string to be matched for the deleted data according to the same feature extraction method; and finally, segmenting the character string to be matched by using the characteristic character string, thereby realizing data recovery. The SQLite deletion recovery technology provided by the scheme can accurately locate deleted records from fragment intervals and accurately recover deleted data records from incomplete fragments; meanwhile, the scheme can recover data only by table structure information, and different records can be recovered from the data space in which the whole page is deleted.

Description

SQLite data deletion recovery method

Technical Field

The invention relates to a database technology, in particular to a data deletion recovery technology.

Background

An intelligent mobile terminal represented by a smart phone is rapidly popularized, brings great convenience to life and work of people, and becomes a necessity in daily life of people.

The SQLite database is adopted by various existing operating systems of intelligent terminals such as Android and iOS, and is used for storing short messages, address lists, call records, instant messaging communication records (such as QQ chat records and micro-messaging communication records) and the like. These data are extremely important for users, and therefore, a technology for recovering data records from deletion has come to be developed, and the technology for recovering data records from deletion can effectively recover data in the event of erroneous deletion.

Meanwhile, the SQLite data deletion recovery technology is also very important in the aspect of electronic data judicial evidence collection and identification. The method can be applied to the recovery of deleted short messages, call records, chat records of instant messaging application and other data in the evidence obtaining and identification work of intelligent terminals such as intelligent mobile phones. These records often contain important case clues and evidence.

However, the existing deletion recovery technology for data records mainly has the following disadvantages in the actual operation process:

the deleted data is difficult to effectively recover aiming at the condition that the whole page of data is deleted; in addition, for the condition that the free space is damaged or a part of bytes are occupied, the conventional recovery method can cause the condition that the recovered data has dislocation, and the data is difficult to be accurately recovered.

Disclosure of Invention

Aiming at the problems of the data record deletion recovery technology in the existing SQLite database, a new SQLite data deletion recovery technology is needed.

Therefore, the technical problem to be solved by the invention is to provide an SQLite data deletion recovery method to effectively recover a large amount of deleted information.

In order to solve the technical problem, the SQLite data deletion recovery method provided by the invention comprises the following steps:

constructing and recording the segmented characteristic character string by using the table structure information;

according to a reverse order mode, constructing a character string to be matched for the deleted data according to the same feature extraction method;

and segmenting the character string to be matched by using the characteristic character string.

Further, the characteristic character string represents type information of a column in the data table, and does not contain length information of the column.

Further, the method searches all table structure information from the data to be recovered, and splits the data to be recovered into different groups based on the table structure information, wherein each group corresponds to one deleted data; each column of data in the plurality of column groups is represented by a letter, and the letters corresponding to the plurality of columns are combined to form a characteristic character string.

Furthermore, the method translates the data to be recovered from back to front, translates each byte into column information, if the translation is successful, the column information is represented by using the letter corresponding to the column information, and if the translation is unsuccessful, the column information is represented by using a star or other special symbols.

Further, the method comprises:

(1) constructing a characteristic character string according to the table structure information;

(2) locating unused space in the SQLite file;

(3) translating the unused space according to columns to form a corresponding longer character string;

(4) searching the longer character string obtained in the step (3) by using the characteristic character string constructed in the step (1), and splitting the original unused space according to the searched position; each of the split data blocks contains a complete record of information.

The SQLite deletion recovery technology provided by the scheme can accurately locate deleted records from fragment intervals and accurately recover deleted data records from incomplete fragments; meanwhile, the scheme can recover data only by table structure information, and different records can be recovered from the data space in which the whole page is deleted.

According to the SQLite deletion recovery technology, when the technology is applied specifically, whether related application programs are deleted or not, a large amount of deleted information can be recovered effectively as long as the SQLite database file still exists.

Drawings

The invention is further described below in conjunction with the appended drawings and the detailed description.

FIG. 1 is a schematic diagram of a Sqlite data storage format;

FIG. 2 is a schematic diagram of data content areas in a Sqlite data record.

Detailed Description

In order to make the technical means, the creation characteristics, the achievement purposes and the effects of the invention easy to understand, the invention is further explained below by combining the specific drawings.

The embodiment utilizes table structure information to construct and record segmented characteristic character strings aiming at the Sqlite data storage format, and then constructs character strings to be matched for deleted data according to the same characteristic extraction method in a reverse order mode; and then, the character string to be matched is segmented by using the characteristic character string so as to accurately separate different records.

When the sqlite stores data, the column information of each group of data and the corresponding data length of the column are recorded at the beginning of each group of data. After a piece of data to be restored is taken, all column header information is searched from the piece of data, so that the piece of data to be restored can be divided into different groups, and each group corresponds to one deleted data. The "column header information" here is table structure information.

Therefore, each column in the plurality of columns is represented by a letter, and the letters corresponding to the plurality of columns are combined to form the corresponding characteristic character string.

The reverse way here is to translate the corresponding data to be recovered from back to front, try to translate each byte into column information, if the translation is successful, the column information is used for representing the translation, and if the translation is unsuccessful, the column information is used for representing the translation. The string thus translated is denoted by S. The column information is translated in the same way, namely ELNOP, so that the data which starts from E and is followed by a piece of data is a piece of complete deleted data.

Based on the principle, the scheme can realize the recovery of the deleted SQLite data through the following basic flow:

(1) firstly, a characteristic character string is constructed according to the table structure information.

(2) And then locate the unused space in the sqlite file.

(3) The unused space is translated by columns to form a longer string.

(4) Searching the longer character string obtained in the step (3) by using the characteristic character string obtained in the step (1), and splitting the original unused space according to the searched position; each of the split data blocks contains a complete record of information.

The following describes a specific implementation of the present solution.

For the Sqlite data storage format, Sqlite data stores data by page. Each page contains fixed header information. The remaining space then stores all the record data of the data table.

Referring to fig. 1, the unit content area stores record data of the sqlite data table. The direction of data growth is in a bottom-up fashion. The old record is stored at the bottom of the page in terms of address space, and then the new record data is stored at the head of the page.

The key to the recovery of Sqlite deleted data is the analysis of the recorded data. The format of the data record is fixed. A complete recorded data consists mainly of 2 parts, recording header information, and recorded data content. All of these 2 parts are variable length and not fixed length.

Header information: total length of this record (1 to 9 bytes, not fixed length), RowID information (1 to 9 bytes, not fixed length, RowID is auto-increment, assigned by sqlite data engine).

Data content area: the content of the sqlite data record includes column information, data of each column, and the like (as shown in fig. 2).

Wherein, the head-size: total length of column information area, non-fixed length (1 to 9 bytes)

Type1, Type2 … Type N: column information, sqlite, uses a more specific identification method, each Type may occupy 1 to 9 bytes. And according to the value range of the Type content, indicating the Data Type and the Data length of the corresponding Data area.

Data1, Data2 … DataN: the information of the data column records the content of each column of data. Data is stored contiguously between adjacent columns without any partitioning flag. The data columns need to be distinguished by the content of the parse Type area.

For the above Sqlite data storage format, the data deletion principle is as follows:

the Sqlite data deletion does not really clear the content of each record, but does some hands and feet at the head of the unnecessary data record to mark the area as free and can be recycled.

The flag for the free area of Sqlite is to overwrite two fields in the header of this block of data, for a total of 4 bytes of content:

a) the first byte and the second byte of the idle area can write the serial number of the next idle area;

b) the third and fourth bytes of the free area will write the total length of the free area.

The scheme is determined by researching and analyzing the Sqlite data deletion principle: if a record is deleted in the sqlite database, it must lose the original 4 bytes of the header. If several records are deleted at a time in succession, only the last one of the several deleted records (i.e., the one with the most forward storage location) will be overwritten by 4 bytes of the header, leaving several deleted records without any loss of information.

It can be determined that when the Sqlite data is deleted, the important data content is not always covered by the necessarily lost 4 bytes.

Since each record is originally stored with "total length of record data" and RowID. The scheme determines through analysis that the 4 lost bytes have the following influences according to different scenes of deleting data, and the specific influences are shown in table 1:

table 1 several scenarios for deleting data

As can be seen from the above table, if the column information is not destroyed, the data content can be completely recovered. And when the column information is damaged, other auxiliary means are needed for analysis and positioning.

Therefore, according to the scheme, the deleted data content can be accurately recovered by accurately positioning the column information of each record according to the Sqlite data storage and deletion principle.

The key of data recovery is the reduction analysis of column information, and according to the data storage principle of sqlite, the column type and column length of sqlite recorded data are identified by data values, as shown in the following table:

according to the scheme, a new identification method is constructed for each value range, only the type information of the column is represented, and the length information of the column is not contained, namely the last field of the table.

Therefore, for the same data table, although the column information areas recorded in each row are completely different, the scheme can be converted into a uniform form through a constructed new identification method. For example, in the most complicated case that a table contains 4 columns, and each column is a character string type, the scheme can be uniformly and formally identified as SSSS.

Accordingly, for a deleted data area, the present solution first assumes that each byte may be column data information, and then may identify this deleted data area as an identification form similar to the following (where × "represents data content that cannot be converted into column information):

*****SSSS********SS*****S******SSSSSS******SSSS****SS*****

after the content of the deleted data area is converted as above, the deleted data area may be further cut into a plurality of records. When the deleted data is recovered, in order to improve the recovery accuracy, the scheme adopts the steps of recovering the complete record of the column information firstly and then trying to recover the data under the condition that the column data is lost.

The Sqlite data deletion recovery scheme is formed in such a way that the recovery process of the data in the case of the integrity of the data is as follows:

the recovery under the condition of complete data is simpler, because the column information is complete, only the SSSS needs to be positioned through the scheme, and the positioning point can be assumed to be the starting point of the deleted recorded column information.

Then, reading a few bytes of content before the positioning point, and verifying according to the Sqlite data storage principle to judge whether the positioning point is a real positioning point.

Once it is confirmed that this is a true anchor point, the data content of this segment can be restored back immediately without any loss of data.

The recovery accuracy in this case is 100%. After the data is restored, the records that are successfully restored need to be deleted from the entire deleted data area, and the remaining data content may become as follows:

*****S*****S****SSSSSS******SS**S**

the deleted data recovery is then converted into the recovery in the case of column information missing, i.e. the information with complete column information is extracted from the piece of data, and the rest is the data with incomplete column information or junk data.

According to the Sqlite data deletion recovery scheme, the recovery process under the condition that data are incomplete is as follows:

from the analysis of table 1, the information that the deleted data record is at most covered by the first column can be obtained. Therefore, for a table with column information identified as a NOPES (i.e. the table corresponding to the NOPES is a table with signed integers in the first column, signed integers in the second column and having a length of 6, signed integers in the third column and having a length of 8, floating point numbers in IEEE format in the fourth column, and character string type in the fifth column of the data table), the present scheme can continue to search for anchor points only by matching an OPES in the remaining data.

Corresponding to the previous step, only the information that the matching sequence is SSS needs to be adjusted.

However, in this case, since both the length information of the recording data and the length information of the column information area are destroyed, they cannot be used as a reference for confirming the anchor point. Therefore, the sequence of matching the SSS also needs to be adjusted in the scheme, and the scheme is adjusted to match in a back-to-front mode. After SSS is matched, the length information of the found anchor point to the end of the data area can be used to deduce whether this anchor point is accurate or not.

Once the anchor point is confirmed, a piece of content can be dug out from the deleted data area to be restored.

The foregoing shows and describes the general principles, essential features, and advantages of the invention. It will be understood by those skilled in the art that the present invention is not limited to the embodiments described above, which are described in the specification and illustrated only to illustrate the principle of the present invention, but that various changes and modifications may be made therein without departing from the spirit and scope of the present invention, which fall within the scope of the invention as claimed. The scope of the invention is defined by the appended claims and equivalents thereof.

Claims

An SQLite data deletion recovery method, comprising:

constructing and recording the segmented characteristic character string by using the table structure information;

according to a reverse order mode, constructing a character string to be matched for the deleted data according to the same feature extraction method;

segmenting the character string to be matched by using the characteristic character string;

the method comprises the steps of searching all table structure information from data to be recovered, splitting the data to be recovered into different groups based on the table structure information, wherein each group corresponds to one deleted data; expressing each column of data in the plurality of column groups by using a letter, and combining the letters corresponding to the plurality of columns to form a characteristic character string;

the method is used for translating the data to be recovered from back to front, translating each byte into column information, representing the byte by using a letter corresponding to the column information if the data to be recovered can be translated successfully, and representing the byte by using a star or other special symbols if the data to be recovered cannot be translated successfully.
2. The SQLite data deletion recovery method of claim 1, wherein the signature string represents type information of a column in a data table, and does not contain length information of the column.
3. The SQLite data deletion recovery method of claim 1, wherein the method comprises:

(1) constructing a characteristic character string according to the table structure information;

(2) locating unused space in the SQLite file;

(3) translating the unused space according to columns to form a corresponding longer character string;

(4) searching the longer character string obtained in the step (3) by using the characteristic character string constructed in the step (1), and splitting the original unused space according to the searched position; each of the split data blocks contains a complete record of information.