SQLCipher
Definition
An open-source SQLite extension that encrypts the entire database file using AES-256. Used by Signal and some other security-focused messaging apps. Without the decryption key, the database file is unreadable.
- Type
- SQLite extension
- Encryption
- AES-256, whole database file
- Notable user
- Signal messenger
- Without key
- Database file is unreadable
Common questions
Can a forensic examiner recover data from an SQLCipher database without the passphrase?+
Not through the database file alone, since the entire file including its headers is encrypted; examiners instead target the key material in device memory, a keychain or keystore, or an unencrypted backup where one exists.
Does SQLCipher encrypt metadata like table names along with the row data?+
Yes, because it encrypts the file at the page level before SQLite's own structures are written, so table definitions, indexes, and row content are all opaque without the key.
Related terms
- Content Provider (Android)
- An Android system component that mediates access to shared data such as call logs and SMS. Forensic logical extractions query content providers...
- Free Page (SQLite)
- A SQLite database page that has been deallocated after a delete operation but not yet reused. Residual message data in free pages...
- Message Status Flag
- An integer column in a messaging database that encodes the state of a message: sent, delivered, read, failed, or draft. The exact...
- SQLite
- A lightweight, serverless relational database engine used pervasively on both iOS and Android to store structured app data including messages, call logs,...
- Unix Epoch Timestamp
- An integer representing the number of seconds (or, in some databases, milliseconds or nanoseconds) since 00:00:00 UTC on 1 January 1970. Mobile...