{"id":992,"date":"2024-11-28T20:09:37","date_gmt":"2024-11-28T20:09:37","guid":{"rendered":"https:\/\/elusivedata.io\/?p=992"},"modified":"2025-07-18T18:04:34","modified_gmt":"2025-07-18T18:04:34","slug":"recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/fi\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","title":{"rendered":"Poistettujen tietojen palauttaminen SQLitest\u00e4: Freeblock-ketjussa navigoiminen"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Johdanto<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

SQLite-tietokannat ovat monista sovelluksista l\u00f6ytyvien digitaalisten todisteiden aarreaittoja, chat-viesteist\u00e4 tapahtumalokeihin. Mutta mit\u00e4 tapahtuu, kun tietueet poistetaan? Tule mukaan freeblocks<\/em>-tietokantasivujen sis\u00e4ll\u00e4 olevat k\u00e4ytt\u00e4m\u00e4tt\u00f6m\u00e4n tilan piilotetut osat, joihin on j\u00e4\u00e4nyt j\u00e4\u00e4nteit\u00e4 poistetuista tiedoista. N\u00e4m\u00e4 vapaat lukot ovat kultakaivos rikostutkijoille, sill\u00e4 ne mahdollistavat kriittisten tietueiden palauttamisen ja piilotettujen todisteiden paljastamisen.<\/p>

T\u00e4ss\u00e4 blogissa selvitet\u00e4\u00e4n SQLiten vapaasulkujen toiminta, niiden paikantaminen heksanmuokkainten kaltaisilla ty\u00f6kaluilla ja poistettujen tietueiden palauttaminen. Olitpa sitten tutkija tai digitaalisen rikostekniikan harrastaja, t\u00e4m\u00e4 opas antaa sinulle keskeiset tekniikat piilotettujen tietojen poimimiseen.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Mit\u00e4 ovat SQLiten freeblockit?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Vapaat lukot ovat SQLite-tietokantasivun k\u00e4ytt\u00e4m\u00e4tt\u00f6m\u00e4n tilan osia. Kun tietue poistetaan, vastaavaa tilaa ei heti ylikirjoiteta, ellei turvallista poistomekanismia ole otettu k\u00e4ytt\u00f6\u00f6n. Sen sijaan se merkit\u00e4\u00e4n freeblock<\/strong>, saatavilla tulevia kirjoituksia varten.<\/p>\n

T\u00e4ss\u00e4 prosessissa:<\/p>\n

    \n
  • Poistetun tietueen osoitin poistetaan.<\/li>\n
  • Sivun otsikko p\u00e4ivitet\u00e4\u00e4n vastaamaan poistoa.<\/li>\n
  • Ensimm\u00e4iseen vapaaseen lohkoon osoittavaa siirtym\u00e4\u00e4 s\u00e4\u00e4det\u00e4\u00e4n tarvittaessa.<\/li>\n<\/ul>\n

    \u00a0<\/p>\n

    N\u00e4iss\u00e4 vapaissa lukoissa on usein j\u00e4\u00e4nteit\u00e4 alkuper\u00e4isist\u00e4 tiedoista, joten ne ovat kriittinen kohde rikostutkijoille, jotka pyrkiv\u00e4t palauttamaan poistetut tietueet.<\/p>\n

    Esimerkki:<\/h4>\n

    Alla olevassa kuvakaappauksessa tarkastelemme SQLite-tietokantaa DB Browserin avulla. \"messages\"-taulussa on kaksi el\u00e4v\u00e4\u00e4 tietuetta, mutta rikostekniset vihjeet viittaavat siihen, ett\u00e4 taulussa on muitakin poistettuja tietueita.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Kuinka vapaasulut sopivat SQLite-sivun otsikoihin<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Jotta voimme etsi\u00e4 ja analysoida vapaasulkuja, meid\u00e4n on ensin ymm\u00e4rrett\u00e4v\u00e4 SQLite-tietokannan sivujen rakenne. Jokainen sivu sis\u00e4lt\u00e4\u00e4 otsikon, joka sis\u00e4lt\u00e4\u00e4 kriittist\u00e4 metatietoa, mukaan lukien osoittimet vapaasulkuihin.<\/p>\n

    Alla olevassa taulukossa esitet\u00e4\u00e4n 0D-sivutyypin otsikkorakenne:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n
    Offset<\/th>\r\n Koko<\/th>\r\n Kuvaus<\/th>\r\n <\/tr>\r\n <\/thead>\r\n
    0<\/td>\r\n 1 tavu<\/td>\r\n Sivun tyyppi<\/td>\r\n <\/tr>\r\n
    1<\/td>\r\n 2 tavua<\/td>\r\n Tavun siirtym\u00e4 ensimm\u00e4iseen vapaaseen lohkoon<\/strong><\/td>\r\n <\/tr>\r\n
    3<\/td>\r\n 2 tavua<\/td>\r\n Sivun solujen lukum\u00e4\u00e4r\u00e4<\/td>\r\n <\/tr>\r\n
    5<\/td>\r\n 2 tavua<\/td>\r\n Offset solun sis\u00e4ll\u00f6n ensimm\u00e4iseen tavuun<\/td>\r\n <\/tr>\r\n
    7<\/td>\r\n 1 tavu<\/td>\r\n Fragmentoituneiden vapaiden tavujen m\u00e4\u00e4r\u00e4 soluissa<\/td>\r\n <\/tr>\r\n <\/tbody>\r\n<\/table>\r\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Keskeinen asia:<\/h4>\n

    Sivun otsikon siirtym\u00e4 1 osoittaa ensimm\u00e4iseen vapaaseen lohkoon. Jos t\u00e4m\u00e4 arvo on 0x0000<\/code>, sivulla ei ole ilmaislukkoja.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Hex-editorien k\u00e4ytt\u00e4minen freeblockien analysointiin<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Ensimm\u00e4isen vapaan lukon paikallistamiseksi avaamme tietokannan heksanmuokkausohjelmalla. Sivun otsakkeen siirtym\u00e4ss\u00e4 1 oleva kahden tavun arvo kertoo freeblockin sijainnin.<\/p>\n

    Alla olevassa esimerkiss\u00e4:<\/p>\n

      \n
    • Hex-editori korostaa offset 0x03A9<\/code> (desimaaliluku 937) punaisella, joka osoittaa ensimm\u00e4isen vapaan lohkon sijainnin.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Siirtyminen t\u00e4h\u00e4n siirtym\u00e4\u00e4n paljastaa vapaan lohkon alun. Seuraavassa tarkastellaan solua, joka sijaitsee kohdassa 937.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Freeblock-otsakkeiden purkaminen<\/h3>\n

      Kukin vapaalohko sis\u00e4lt\u00e4\u00e4 nelj\u00e4n tavun otsikon, joka sis\u00e4lt\u00e4\u00e4:<\/p>\n

        \n
      1. 2 ensimm\u00e4ist\u00e4 tavua<\/strong>: Offset seuraavaan vapaaseen lohkoon (0x0000<\/code> jos sellaista ei ole).<\/li>\n
      2. Toinen 2 tavua<\/strong>: Vapaan lohkon kokonaiskoko, mukaan lukien itse otsikko.<\/li>\n<\/ol>\n

        Esimerkki:<\/h4>\n

        Offsetissa 0x03A9<\/code>, ilmaisee freeblock-otsikko:<\/p>\n

          \n
        • Seuraava vapaa lohko on offsetissa 0x03EA<\/code> (desimaaliluku 1002).<\/li>\n
        • Vapaan lohkon koko on 0x0024<\/code> (36 tavua, otsikko mukaan lukien).<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
          \n\t\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t

          Poistettujen tietueiden palauttaminen k\u00e4ytt\u00e4m\u00e4ll\u00e4 freeblockeja<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
          \n\t\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t

          Vapaat lukot sis\u00e4lt\u00e4v\u00e4t usein j\u00e4\u00e4nteit\u00e4 poistetuista tietueista, mink\u00e4 ansiosta rikostutkijat voivat palauttaa tietoja osittain tai kokonaan. Alla olevassa kuvakaappauksessa poistetun tietueen hy\u00f6tykuorma on ehj\u00e4 ja palautettavissa, vaikka sen osoitin on poistettu.<\/p>\n

          Esimerkki:<\/h4>\n
            \n
          • Poistettu tietue offsetissa 0x03A9<\/code> sis\u00e4lt\u00e4\u00e4 viestin: \"Ei paljon. Mit\u00e4 kuuluu?\"<\/li>\n
          • Keskeiset kent\u00e4t s\u00e4ilyv\u00e4t ennallaan, mukaan lukien viestin sis\u00e4lt\u00f6, vaikka muut metatiedot on korvattu.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
            \n\t\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
            \n\t\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t\t\t\t\t\t

            Analysoimme my\u00f6hempi\u00e4 vapaasulkuja l\u00f6yt\u00e4\u00e4ksemme lis\u00e4\u00e4 poistettuja tietueita. Kun offset 0x03EA<\/code>, paljastaa freeblock-otsikko:<\/p>\n

              \n
            • Vapaan lohkon koko on 0x0016<\/code> (22 tavua).<\/li>\n
            • T\u00e4m\u00e4 on ketjun viimeinen vapaa lohko, kuten osoittaa merkint\u00e4 0x0000<\/code> seuraavaan vapaalohkon osoitinkentt\u00e4\u00e4n.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Alla olevassa kuvakaappauksessa korostetaan ketjun toisen vapaan lohkon koko solualuetta, jossa poistettu viesti oli \"Hei Andy!\".<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t

              Poistettujen lis\u00e4tietueiden tunnistaminen<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              T\u00e4ll\u00e4 sivulla on kuitenkin viel\u00e4 yksi poistettu tietue, johon ei viitata freeblock-ketjussa. Kun tarkastellaan sivun otsikkoa, sivulla oli vain kaksi tietuetta offsetissa 3 olevan kahden tavun arvon mukaan (0x00002<\/code>). Ja koska tietueita on vain kaksi, osoitinjoukossa on vain kaksi osoitinta. N\u00e4m\u00e4 kaksi osoitinta osoittavat tietueeseen #2 - \"Hei, mit\u00e4 kuuluu?\" ja tietueeseen #4 - \"Hei, mietin, onko sinulla Scooby Snaxia\". Saatat huomata, ett\u00e4 sivulla on toinenkin pitk\u00e4 viesti, joka sijaitsee ylemp\u00e4n\u00e4.<\/p>\n

              Sivun otsikon offset-arvossa 5 oleva kahden tavun arvo on solun sis\u00e4lt\u00f6alueen offset-arvo, joka on periaatteessa paikka, johon seuraava tietue kirjoitetaan, ellei se mahdu johonkin vapaaseen lukitukseen. T\u00e4m\u00e4 arvo on 0x0363<\/code> joka on desimaalinen offset 867.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Yll\u00e4 olevassa kuvakaappauksessa nuoli osoittaa sivupisteeseen 867. T\u00e4m\u00e4 on solun sis\u00e4ll\u00f6n alku, mik\u00e4 tarkoittaa, ett\u00e4 seuraava tietue lis\u00e4t\u00e4\u00e4n juuri t\u00e4m\u00e4n tietueen yl\u00e4puolelle. T\u00e4m\u00e4n yl\u00e4puolella oleva poistettu tietue sis\u00e4lt\u00e4\u00e4 viestin: \"Satuin saamaan uuden toimituksen viime y\u00f6n\u00e4. Sinulla on onnea. Kuinka paljon tarvitset?\"<\/p>\n

              Tietokanta pit\u00e4\u00e4 t\u00e4t\u00e4 tietoa varaamattomana tilana. Se voitaisiin yht\u00e4 hyvin t\u00e4ytt\u00e4\u00e4 0x00<\/code> koska osoitinjoukossa ei ole osoitinta, joka osoittaisi sit\u00e4.\u00a0

              Jos taulukkoon, johon t\u00e4m\u00e4 sivu kuuluu, lis\u00e4t\u00e4\u00e4n tietue, joka on liian suuri mahtuakseen sivun kahteen vapaaseen lukitukseen, se korvaa viestin, joka sattuu olemaan tietue #5.\u00a0<\/p>\n

              Katsotaanpa, milt\u00e4 tilanne n\u00e4ytt\u00e4\u00e4 nyt, kun olemme tunnistaneet kaksi vapaata lukitusta ja kolmannen poistetun tietueen, joka odottaa korvaamista:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Analysoituamme tietokannan raakamuodossaan voimme p\u00e4\u00e4tell\u00e4, ett\u00e4 se sis\u00e4lsi enemm\u00e4n kuin vain kaksi \"el\u00e4v\u00e4\u00e4\" tietuetta, jotka tietokannan katseluohjelma n\u00e4ytti.\u00a0<\/p>\n

              Tietue #1 oli todenn\u00e4k\u00f6isesti viesti \"Hei Andy!\", kun taas tietue #3 oli todenn\u00e4k\u00f6isesti viesti \"Ei paljon. Mit\u00e4 kuuluu?\". Tietue #5:n solussa on edelleen sen tietueen numero, joka on tunnistettu viestiksi: \"Satuin saamaan uutta tavaraa viime y\u00f6n\u00e4. Sinulla on onnea. Kuinka paljon tarvitset?\"<\/p>\n

              \u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t

              P\u00e4\u00e4telm\u00e4<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Vapaat lukitukset ovat tehokas ty\u00f6kalu rikosteknisess\u00e4 tutkimuksessa, sill\u00e4 ne tarjoavat mahdollisuuden n\u00e4hd\u00e4 poistettuja tietueita ja jakamattomia tietoja. Kun tutkijat hallitsevat n\u00e4m\u00e4 tekniikat, he voivat paljastaa tietokantojen j\u00e4tt\u00e4m\u00e4t digitaaliset j\u00e4ljet.<\/p>

              Oletko valmis viem\u00e4\u00e4n SQLite-tekniset taitosi seuraavalle tasolle? Tutustu edistyneempiin koulutusohjelmiimme tai ota meihin yhteytt\u00e4, niin kerromme, miten voimme auttaa sinua kehittym\u00e4\u00e4n rikostekniseksi asiantuntijaksi.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

              Avaa SQLiten vapaan lukituksen salaisuudet ja opi palauttamaan poistetut tietueet rikosteknisten tekniikoiden avulla.<\/p>","protected":false},"author":1,"featured_media":1271,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[21],"tags":[57],"class_list":["post-992","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mobile-forensics","tag-sqlite-databases"],"acf":[],"yoast_head":"\nRecovering Deleted Data from SQLite: Navigating the Freeblock Chain<\/title>\n<meta name=\"description\" content=\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/fi\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/\" \/>\n<meta property=\"og:locale\" content=\"fi_FI\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\" \/>\n<meta property=\"og:description\" content=\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/fi\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-28T20:09:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain-1024x574.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"574\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Kirjoittanut\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Arvioitu lukuaika\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minuuttia\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\",\"datePublished\":\"2024-11-28T20:09:37+00:00\",\"dateModified\":\"2025-07-18T18:04:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"},\"wordCount\":1036,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"keywords\":[\"SQLite Databases\"],\"articleSection\":[\"Mobile Forensics\"],\"inLanguage\":\"fi\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\",\"name\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"datePublished\":\"2024-11-28T20:09:37+00:00\",\"dateModified\":\"2025-07-18T18:04:34+00:00\",\"description\":\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#breadcrumb\"},\"inLanguage\":\"fi\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fi\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"width\":2912,\"height\":1632,\"caption\":\"Step-by-step guide to recovering deleted data from SQLite databases using the freeblock chain.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fi\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fi\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fi\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/fi\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Poistettujen tietojen palauttaminen SQLitest\u00e4: Freeblock-ketjussa navigoiminen","description":"Opi palauttamaan poistetut tiedot SQLite-tietokannoista ymm\u00e4rt\u00e4m\u00e4ll\u00e4 ja navigoimalla freeblock-ketjua. T\u00e4m\u00e4 opas tarjoaa rikostutkijoille keskeisi\u00e4 tekniikoita tietojen palauttamiseen.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/fi\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","og_locale":"fi_FI","og_type":"article","og_title":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain","og_description":"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.","og_url":"https:\/\/elusivedata.io\/fi\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","og_site_name":"Elusive Data","article_published_time":"2024-11-28T20:09:37+00:00","article_modified_time":"2025-07-18T18:04:34+00:00","og_image":[{"width":1024,"height":574,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain-1024x574.png","type":"image\/png"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_misc":{"Kirjoittanut":"James Eichbaum","Arvioitu lukuaika":"7 minuuttia"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain","datePublished":"2024-11-28T20:09:37+00:00","dateModified":"2025-07-18T18:04:34+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"},"wordCount":1036,"commentCount":0,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","keywords":["SQLite Databases"],"articleSection":["Mobile Forensics"],"inLanguage":"fi","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","url":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","name":"Poistettujen tietojen palauttaminen SQLitest\u00e4: Freeblock-ketjussa navigoiminen","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","datePublished":"2024-11-28T20:09:37+00:00","dateModified":"2025-07-18T18:04:34+00:00","description":"Opi palauttamaan poistetut tiedot SQLite-tietokannoista ymm\u00e4rt\u00e4m\u00e4ll\u00e4 ja navigoimalla freeblock-ketjua. T\u00e4m\u00e4 opas tarjoaa rikostutkijoille keskeisi\u00e4 tekniikoita tietojen palauttamiseen.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#breadcrumb"},"inLanguage":"fi","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"]}]},{"@type":"ImageObject","inLanguage":"fi","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","width":2912,"height":1632,"caption":"Step-by-step guide to recovering deleted data from SQLite databases using the freeblock chain."},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain"}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"ElusiveData","description":"Huippuosaamista digitaalisen rikostekniikan koulutuksessa ja konsultoinnissa","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fi"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"ElusiveData","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"fi","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"fi","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/fi\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/fi\/wp-json\/wp\/v2\/posts\/992","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/fi\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/fi\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/fi\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/fi\/wp-json\/wp\/v2\/comments?post=992"}],"version-history":[{"count":59,"href":"https:\/\/elusivedata.io\/fi\/wp-json\/wp\/v2\/posts\/992\/revisions"}],"predecessor-version":[{"id":1437,"href":"https:\/\/elusivedata.io\/fi\/wp-json\/wp\/v2\/posts\/992\/revisions\/1437"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/fi\/wp-json\/wp\/v2\/media\/1271"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/fi\/wp-json\/wp\/v2\/media?parent=992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/fi\/wp-json\/wp\/v2\/categories?post=992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/fi\/wp-json\/wp\/v2\/tags?post=992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}