计算机应用 ›› 2017, Vol. 37 ›› Issue (2): 392-396.DOI: 10.11772/j.issn.1001-9081.2017.02.0392

• 第十届中国可信计算与信息安全学术会议 • 上一篇    下一篇

基于SQLite内容雕刻的恢复技术

马庆杰1,2, 李炳龙1,2, 位丽娜1,2   

  1. 1. 信息工程大学, 郑州 450004;
    2. 数学工程与先进计算国家重点实验室, 郑州 450004
  • 收稿日期:2016-08-15 修回日期:2016-08-30 出版日期:2017-02-10 发布日期:2017-02-11
  • 通讯作者: 李炳龙,lblc2006@163.com
  • 作者简介:马庆杰(1987-),男,河南安阳人,硕士,主要研究方向:数字取证;李炳龙(1974-),男,河南新乡人,副教授,博士,CCF会员,主要研究方向:数字取证、信息系统容灾处理;位丽娜(1990-),女,河南周口人,硕士,主要研究方向:Linux文件系统取证。
  • 基金资助:
    国家自然科学基金资助项目(60903220);郑州市科技攻关项目(10PTGG3415)。

File recovery based on SQlite content carving

MA Qingjie1,2, LI Binglong1,2, WEI Lina1,2   

  1. 1. Information Engineering University, Zhengzhou Henan 450004, China;
    2. State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou Henan 450004, China
  • Received:2016-08-15 Revised:2016-08-30 Online:2017-02-10 Published:2017-02-11
  • Supported by:
    This work is partially supported by the National Natural Science Foundation of China (60903220), the Science and Technology Project of Zhengzhou (10PTGG3415).

摘要: SQLite数据库被众多即时通信软件用于存储历史数据。在即时通信取证过程中,犯罪分子为阻碍司法部门的调查,往往隐藏、删除或覆盖重要的通信数据。目前的数据恢复方法效率较低,无法恢复被覆盖的数据。针对上述问题,提出了一种基于SQLite的内容雕刻算法,分析SQLite数据库文件的存储特性和数据删除机制,以空闲域为单位形成空闲域链表,以页结构为单位进行细粒度的内容雕刻,并根据数据被覆盖的位置对零散数据块进行有效拼接。实验结果表明,SQLite内容雕刻算法可有效在本地和移动终端恢复即时通信的历史数据,当数据库未受损时,恢复率可达到100%;而当删除域受到不同程度的覆盖时,恢复率仍然可达到50%左右,并具有较高的效率。

关键词: SQLite, 删除域, 即时通信, 取证调查, 内容雕刻, 恢复率

Abstract: The SQLite is applied by a number of Instant Messaging (IM) softwares for history data storing. In the process of IM forensics, to impede the investigation of the judiciary, the important SQLite data are often hidden, deleted or overwritten by criminals. The current data recovery methods are inefficient and cannot extract the overwritten data. A content carving algorithm based on SQLite was proposed to resolve the above problems. According to SQLite database storage characteristics and data deletion mechanism, the free domain was regarded as units to form idle list, the page content was used to grain structural units of engraving, and the scattered blocks of data were spliced efficiently on the basis of the position of data overwritten. The experimental results show that the propsed SQLite content carving algorithm can effectively recover IM data in local and mobile terminals; the recovery rate reaches 100% when the database is not damaged, and the recovery rate still reaches about 50% when the delete area is overwritten in different degrees.

Key words: SQLite, delete area, Instant Messaging (IM), forensics and investigation, content carving, recovery rate

中图分类号: