SQLite database format
SQLite databases are used by many programs including several forensics tools, e.g. Autopsy 3. SQLite 3 is current and older SQLite packages cannot use sqlite3 databases so use sqlite3 tools.
SQLite version 3 uses a page-based storage where the pages are used for various types of data e.g. there are:
- lock-byte pages
- freelist pages
- freelist trunk pages
- freelist leaf pages
- B-tree pages
- table B-tree interior pages
- table B-tree leaf pages
- index B-tree interior pages
- index B-tree leaf pages
- payload overflow pages
- pointer map pages
Write-Ahead Log (WAL)
The default method by which SQLite implements atomic commit and rollback is a rollback journal. In version 3.7.0 a "Write-Ahead Log" option was added.
Temporary sqlite files
Seen in e.g.
Where "etilqs" is "sqlite" in reverse
Web Browser Data
- The SQLite Database File Format, by the SQLite project
- Write-Ahead Logging, by the SQLite project
- Carving SQLite databases from unallocated clusters, by Richard Drinkwater, April 27, 2011
- Recovering Data from Deleted SQLite Records: Redux, by John Lehr, September 13, 2013