SQLite
Definition
A lightweight, serverless relational database engine used pervasively on both iOS and Android to store structured app data including messages, call logs, browsing history, and location records. SQLite databases are single files with a .db or .sqlite extension and can be opened with standard SQLite tools.
- Field
- Mobile and digital forensics
- Type
- Serverless relational database engine
- File extensions
- .db, .sqlite
- Common artifacts
- Messages, call logs, browsing history, location records
Common questions
Why is SQLite so central to mobile forensic examinations?+
Nearly every native and third-party app on iOS and Android stores its structured data in a SQLite file, so examiners routinely find messaging history, contacts, and app state inside these databases rather than in plain text logs. Recognising and parsing them is a core mobile forensics skill.
Can deleted records be recovered from a SQLite database?+
Often yes, because SQLite does not always overwrite freed space immediately. Deleted rows can persist in unallocated pages or in the write-ahead log until the database is vacuumed or the space is reused, which is why examiners carve these files rather than only reading live records.
Related terms
- App Sandbox Container
- An isolated directory assigned to each app on iOS under /var/mobile/Containers/Data/Application/<UUID>/. The container holds all of the app's Documents, Library, and tmp...
- Content Provider (Android)
- An Android system component that mediates access to shared data such as call logs and SMS. Forensic logical extractions query content providers...
- Free Page (SQLite)
- A SQLite database page that has been deallocated after a delete operation but not yet reused. Residual message data in free pages...
- iOS Keychain
- A hardware-backed secure credential store on iOS devices that holds passwords, authentication tokens, and cryptographic keys. Keychain items are encrypted with keys...
- Message Status Flag
- An integer column in a messaging database that encodes the state of a message: sent, delivered, read, failed, or draft. The exact...
- NAND Flash
- The type of non-volatile memory used in all modern mobile device storage. Data is written to pages grouped into blocks; erasure operates...
- Plist (Property List)
- A structured data format native to Apple operating systems, available in XML and binary variants. iOS uses plist files to store app...
- SQLCipher
- An open-source SQLite extension that encrypts the entire database file using AES-256. Used by Signal and some other security-focused messaging apps. Without...
- Unix Epoch Timestamp
- An integer representing the number of seconds (or, in some databases, milliseconds or nanoseconds) since 00:00:00 UTC on 1 January 1970. Mobile...
- Wear-Leveling
- A flash storage controller behavior that distributes write operations across all available memory cells to prevent premature failure of any single cell....
Explained in these topics
- Call Logs, SMS, and Messaging App ArtifactsA self-contained, serverless relational database engine used by both Android and iOS to store call logs, messages, and app data. Each database is a single file...
- Data Persistence and Evidence Locations on Mobile Devices