Method and device for recovering deleted sqlite files on mobile terminal

Abstract

The invention provides a method and a device for recovering deleted sqlite files on a mobile terminal. The method includes that a plurality of types of sqlite page characteristic rules are set in advance, and when the mobile terminal is detected, the following steps are executed, and the steps include obtaining image files of the current mobile terminal; analyzing the image files of the current mobile terminal and arranging a searching region; calling at least one sqlite page characteristic rule which is arranged in advance according to data characteristic in the searching region, and performing matching for the data in the searching region according to the sqlite page characteristic rule serving as a matching base to obtain page fragments of the deleted sqlite files on the current mobile terminal; and finally decoding the data in the page fragments of the deleted sqlite files on the current mobile terminal. According to the technical scheme, the valid data in the uncovered page fragments of all the deleted sqlite files on the mobile terminal can be obtained, and the recovery success rate and recovery integrity are high.

Description

technical field [0001] The invention relates to the technical field of data recovery, in particular to a method and device for recovering deleted sqlite files of a mobile terminal. Background technique [0002] Electronic data recovery refers to the technology of rescuing and recovering lost electronic data originally stored on storage media such as desktop hard disks, notebook hard disks, server hard disks, storage tape libraries, mobile hard disks, and digital memory cards through technical means. In electronic data forensics, the role of data recovery is particularly important. [0003] At present, for iOS mobile smart terminals, in the process of electronic data forensics, it is often encountered that the user’s contacts, chat records and other information cannot be obtained during forensics because the user has deleted the QQ, Fetion, Weibo and other applications on the device. question. Most of these data are stored in sqlite files, and iOS recovers a limited number ...

AI Technical Summary

Problems solved by technology

[0005] The present invention provides a method and device for recovering deleted sqlite files of a mobile terminal, which is used to solve the problem in the prior art that the sqlite file data of an application program that has been uninstalled on a mobile terminal cannot be recovered. The recovery of deleted sqlite files provided by the present invention The file method and device can obtain valid data in page fragments of all deleted sqlite files not covered by the mobile terminal, and has the characteristics of high recovery success rate and high recovery integrity

Images