SQLite
Definition
A lightweight, serverless relational database engine used pervasively on both iOS and Android to store structured app data including messages, call logs, browsing history, and location records. SQLite databases are single files with a .db or .sqlite extension and can be opened with standard SQLite tools.
Related terms
- App sandbox container
- An isolated directory assigned to each app on iOS under /var/mobile/Containers/Data/Application/<UUID>/. The container holds all of the app's Documents, Library, and tmp...
- Content provider (Android)
- An Android system component that mediates access to shared data such as call logs and SMS. Forensic logical extractions query content providers...
- Free page (SQLite)
- A SQLite database page that has been deallocated after a delete operation but not yet reused. Residual message data in free pages...
- iOS Keychain
- A hardware-backed secure credential store on iOS devices that holds passwords, authentication tokens, and cryptographic keys. Keychain items are encrypted with keys...
- Message status flag
- An integer column in a messaging database that encodes the state of a message: sent, delivered, read, failed, or draft. The exact...
- NAND flash
- The type of non-volatile memory used in all modern mobile device storage. Data is written to pages grouped into blocks; erasure operates...
- Plist (property list)
- A structured data format native to Apple operating systems, available in XML and binary variants. iOS uses plist files to store app...
- SQLCipher
- An open-source SQLite extension that encrypts the entire database file using AES-256. Used by Signal and some other security-focused messaging apps. Without...
- Unix epoch timestamp
- An integer representing the number of seconds (or, in some databases, milliseconds or nanoseconds) since 00:00:00 UTC on 1 January 1970. Mobile...
- Wear-leveling
- A flash storage controller behavior that distributes write operations across all available memory cells to prevent premature failure of any single cell....
Explained in these topics
- Call Logs, SMS, and Messaging App ArtifactsA self-contained, serverless relational database engine used by both Android and iOS to store call logs, messages, and app data. Each database is a single file...
- Data Persistence and Evidence Locations on Mobile DevicesA lightweight, serverless relational database engine used pervasively on both iOS and Android to store structured app data including messages, call logs, brows...