{"id":992,"date":"2024-11-28T20:09:37","date_gmt":"2024-11-28T20:09:37","guid":{"rendered":"https:\/\/elusivedata.io\/?p=992"},"modified":"2025-07-18T18:04:34","modified_gmt":"2025-07-18T18:04:34","slug":"recuperation-des-donnees-supprimees-de-sqlite-navigation-dans-la-chaine-de-blocs-libres","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/fr\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","title":{"rendered":"R\u00e9cup\u00e9ration de donn\u00e9es effac\u00e9es \u00e0 partir de SQLite : Naviguer dans la cha\u00eene de blocs libres"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Introduction<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Les bases de donn\u00e9es SQLite sont des tr\u00e9sors de preuves num\u00e9riques que l'on trouve dans de nombreuses applications, qu'il s'agisse de messages de chat ou de journaux de transactions. Mais que se passe-t-il lorsque les enregistrements sont supprim\u00e9s ? Entrer blocs libres<\/em>-les sections cach\u00e9es de l'espace inutilis\u00e9 dans les pages de la base de donn\u00e9es qui conservent des restes de donn\u00e9es supprim\u00e9es. Ces blocs libres sont une mine d'or pour les enqu\u00eateurs judiciaires, car ils permettent de r\u00e9cup\u00e9rer des enregistrements critiques et de d\u00e9couvrir des preuves cach\u00e9es.<\/p>

Ce blog d\u00e9mystifie les freeblocks SQLite, en vous expliquant comment ils fonctionnent, comment les localiser \u00e0 l'aide d'outils tels que les \u00e9diteurs hexagonaux et comment r\u00e9cup\u00e9rer les enregistrements supprim\u00e9s. Que vous soyez un enqu\u00eateur ou un passionn\u00e9 de criminalistique num\u00e9rique, ce guide vous fournira les techniques essentielles pour extraire les donn\u00e9es cach\u00e9es.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Que sont les Freeblocks dans SQLite ?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Les blocs libres sont des sections d'espace inutilis\u00e9 dans une page de base de donn\u00e9es SQLite. Lorsqu'un enregistrement est supprim\u00e9, l'espace correspondant n'est pas imm\u00e9diatement \u00e9cras\u00e9, \u00e0 moins qu'un m\u00e9canisme d'effacement s\u00e9curis\u00e9 ne soit activ\u00e9. Au lieu de cela, il est marqu\u00e9 comme un freeblock<\/strong>disponible pour de futures \u00e9critures.<\/p>\n

Dans ce processus :<\/p>\n

    \n
  • Le pointeur sur l'enregistrement supprim\u00e9 est supprim\u00e9.<\/li>\n
  • L'en-t\u00eate de la page est mis \u00e0 jour pour refl\u00e9ter la suppression.<\/li>\n
  • Le cas \u00e9ch\u00e9ant, le d\u00e9calage par rapport au premier bloc libre est ajust\u00e9.<\/li>\n<\/ul>\n

    \u00a0<\/p>\n

    Ces freeblocks conservent souvent des vestiges des donn\u00e9es d'origine, ce qui en fait une cible essentielle pour les enqu\u00eateurs judiciaires qui cherchent \u00e0 r\u00e9cup\u00e9rer des enregistrements supprim\u00e9s.<\/p>\n

    Exemple :<\/h4>\n

    Dans la capture d'\u00e9cran ci-dessous, nous examinons une base de donn\u00e9es SQLite \u00e0 l'aide de DB Browser. La table \"messages\" pr\u00e9sente deux enregistrements vivants, mais des indices m\u00e9dico-l\u00e9gaux sugg\u00e8rent la pr\u00e9sence d'autres enregistrements supprim\u00e9s.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Comment les Freeblocks s'int\u00e8grent dans les en-t\u00eates de page SQLite<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Pour localiser et analyser les freeblocks, nous devons d'abord comprendre la structure des pages de la base de donn\u00e9es SQLite. Chaque page contient un en-t\u00eate qui fournit des m\u00e9tadonn\u00e9es essentielles, notamment des pointeurs vers les freeblocks.<\/p>\n

    Le tableau ci-dessous pr\u00e9sente la structure de l'en-t\u00eate pour un type de page 0D :<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n
    D\u00e9calage<\/th>\r\n Taille<\/th>\r\n Description<\/th>\r\n <\/tr>\r\n <\/thead>\r\n
    0<\/td>\r\n 1 octet<\/td>\r\n Type de page<\/td>\r\n <\/tr>\r\n
    1<\/td>\r\n 2 octets<\/td>\r\n D\u00e9calage d'un octet vers le premier bloc libre<\/strong><\/td>\r\n <\/tr>\r\n
    3<\/td>\r\n 2 octets<\/td>\r\n Nombre de cellules sur la page<\/td>\r\n <\/tr>\r\n
    5<\/td>\r\n 2 octets<\/td>\r\n D\u00e9calage vers le premier octet du contenu de la cellule<\/td>\r\n <\/tr>\r\n
    7<\/td>\r\n 1 octet<\/td>\r\n Nombre d'octets libres fragment\u00e9s dans les cellules<\/td>\r\n <\/tr>\r\n <\/tbody>\r\n<\/table>\r\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Principaux enseignements :<\/h4>\n

    La valeur de l'offset 1 dans l'en-t\u00eate de la page indique le premier bloc libre. Si cette valeur est 0x0000<\/code>il n'y a pas de blocs gratuits sur la page.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Utilisation d'\u00e9diteurs hexagonaux pour analyser les freeblocks<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Pour localiser le premier bloc libre, nous ouvrons la base de donn\u00e9es dans un \u00e9diteur hexad\u00e9cimal. La valeur de deux octets \u00e0 l'offset 1 de l'en-t\u00eate de la page fournit l'offset de l'emplacement du freeblock.<\/p>\n

    Dans l'exemple ci-dessous :<\/p>\n

      \n
    • L'\u00e9diteur hexagonal met en \u00e9vidence le d\u00e9calage 0x03A9<\/code> (d\u00e9cimale 937) en rouge, qui indique l'emplacement du premier bloc libre.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      La navigation vers ce d\u00e9calage r\u00e9v\u00e8le le d\u00e9but du bloc libre. Ci-dessous, nous examinons la cellule situ\u00e9e \u00e0 l'offset 937.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      D\u00e9codage des en-t\u00eates Freeblock<\/h3>\n

      Chaque bloc libre contient un en-t\u00eate de quatre octets comprenant<\/p>\n

        \n
      1. 2 premiers octets<\/strong>: D\u00e9calage vers le bloc libre suivant (0x0000<\/code> s'il n'en existe pas).<\/li>\n
      2. Deuxi\u00e8me 2 octets<\/strong>: Taille totale du bloc libre, y compris l'en-t\u00eate lui-m\u00eame.<\/li>\n<\/ol>\n

        Exemple :<\/h4>\n

        Au d\u00e9calage 0x03A9<\/code>L'en-t\u00eate du bloc libre l'indique :<\/p>\n

          \n
        • Le prochain bloc libre se trouve \u00e0 l'emplacement 0x03EA<\/code> (d\u00e9cimale 1002).<\/li>\n
        • La taille du bloc libre est de 0x0024<\/code> (36 octets, y compris l'en-t\u00eate).<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
          \n\t\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t

          R\u00e9cup\u00e9ration d'enregistrements supprim\u00e9s \u00e0 l'aide de Freeblocks<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
          \n\t\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t

          Les freeblocks contiennent souvent des restes d'enregistrements supprim\u00e9s, ce qui permet aux enqu\u00eateurs de r\u00e9cup\u00e9rer des donn\u00e9es partielles ou compl\u00e8tes. Dans la capture d'\u00e9cran ci-dessous, la charge utile d'un enregistrement supprim\u00e9 est intacte et r\u00e9cup\u00e9rable malgr\u00e9 la suppression de son pointeur.<\/p>\n

          Exemple :<\/h4>\n
            \n
          • L'enregistrement supprim\u00e9 \u00e0 l'emplacement 0x03A9<\/code> contient le message : \"Pas grand-chose. Comment allez-vous ?\"<\/li>\n
          • Les champs cl\u00e9s restent intacts, y compris le contenu du message, m\u00eame si d'autres m\u00e9tadonn\u00e9es ont \u00e9t\u00e9 \u00e9cras\u00e9es.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
            \n\t\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
            \n\t\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t\t\t\t\t\t

            Nous analysons les blocs libres suivants pour d\u00e9couvrir d'autres enregistrements supprim\u00e9s. Au d\u00e9calage 0x03EA<\/code>L'en-t\u00eate du freeblock est r\u00e9v\u00e9lateur :<\/p>\n

              \n
            • La taille du bloc libre est de 0x0016<\/code> (22 octets).<\/li>\n
            • Il s'agit du dernier bloc libre de la cha\u00eene, comme l'indique la mention 0x0000<\/code> dans le champ de pointeurs du bloc libre suivant.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              La capture d'\u00e9cran ci-dessous met en \u00e9vidence l'ensemble de la cellule du deuxi\u00e8me bloc libre de la cha\u00eene o\u00f9 le message supprim\u00e9 \u00e9tait \"Hi Andy !\".<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t

              Identification des documents supprim\u00e9s suppl\u00e9mentaires<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Mais il se trouve qu'il y a un autre enregistrement supprim\u00e9 sur cette page qui n'est pas r\u00e9f\u00e9renc\u00e9 par la cha\u00eene de blocs libres. En regardant l'en-t\u00eate de la page, on constate qu'il n'y avait que deux enregistrements sur cette page, d'apr\u00e8s la valeur de deux octets \u00e0 l'offset 3 (0x00002<\/code>). Et comme il n'y a que deux enregistrements, il n'y a que deux pointeurs dans le tableau de pointeurs. Ces deux pointeurs pointent vers l'enregistrement #2 - \"Hey, what's up ?\" et l'enregistrement #4 - \"Hey, I was wondering if you have any Scooby snax\" (Hey, je me demandais si vous aviez des Scooby snax). Vous remarquerez peut-\u00eatre qu'il y a un autre long message situ\u00e9 plus haut sur la page.<\/p>\n

              La valeur de deux octets \u00e0 l'offset 5 dans l'en-t\u00eate de la page est l'offset de la zone de contenu de la cellule, c'est-\u00e0-dire l'endroit o\u00f9 l'enregistrement suivant sera \u00e9crit, \u00e0 moins qu'il ne puisse tenir dans l'un des blocs libres. Cette valeur est 0x0363<\/code> ce qui correspond \u00e0 l'offset d\u00e9cimal 867.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Dans la capture d'\u00e9cran ci-dessus, la fl\u00e8che pointe vers le d\u00e9calage de page 867. Il s'agit du d\u00e9but du contenu de la cellule, ce qui signifie que l'enregistrement suivant sera ajout\u00e9 juste au-dessus de cet enregistrement. L'enregistrement supprim\u00e9 situ\u00e9 au-dessus contient le message suivant : \"Il se trouve que j'ai re\u00e7u un nouvel approvisionnement hier soir. Vous avez de la chance. De quelle quantit\u00e9 avez-vous besoin ?\"<\/p>\n

              La base de donn\u00e9es consid\u00e8re ces donn\u00e9es comme de l'espace non allou\u00e9. Il pourrait tout aussi bien \u00eatre rempli de 0x00<\/code> car il n'y a pas de pointeur dans le tableau de pointeurs qui l'adresse.\u00a0

              Si un enregistrement trop grand pour tenir dans les deux blocs libres de la page est ajout\u00e9 au tableau auquel appartient cette page, il \u00e9crasera le message, qui se trouve \u00eatre l'enregistrement #5.\u00a0<\/p>\n

              Voyons ce qu'il en est maintenant que nous avons identifi\u00e9 les deux blocs libres ainsi que le troisi\u00e8me enregistrement supprim\u00e9 qui attend d'\u00eatre \u00e9cras\u00e9 :<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Apr\u00e8s avoir analys\u00e9 la base de donn\u00e9es dans son format brut, nous pouvons conclure qu'elle contient plus que les deux enregistrements \"vivants\" affich\u00e9s par le visualiseur de base de donn\u00e9es.\u00a0<\/p>\n

              L'enregistrement #1 \u00e9tait probablement le message \"Bonjour Andy !\" tandis que l'enregistrement #3 \u00e9tait probablement le message \"Pas grand-chose. Comment vas-tu ? L'enregistrement #5 a toujours son num\u00e9ro d'enregistrement dans sa cellule identifi\u00e9e comme le message \"J'ai re\u00e7u une nouvelle livraison hier soir. Vous avez de la chance. De quelle quantit\u00e9 avez-vous besoin ?\"<\/p>\n

              \u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t

              Conclusion<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Les freeblocks sont un outil puissant dans les enqu\u00eates judiciaires, car ils offrent une fen\u00eatre sur les enregistrements supprim\u00e9s et les donn\u00e9es non allou\u00e9es. En ma\u00eetrisant ces techniques, les enqu\u00eateurs peuvent d\u00e9couvrir les traces num\u00e9riques laiss\u00e9es par les bases de donn\u00e9es.<\/p>

              Vous \u00eates pr\u00eat \u00e0 passer au niveau sup\u00e9rieur en ce qui concerne vos comp\u00e9tences en mati\u00e8re de criminalistique SQLite ? D\u00e9couvrez nos programmes de formation avanc\u00e9e ou contactez-nous pour savoir comment nous pouvons vous aider \u00e0 devenir un expert en criminalistique.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

              Percez les secrets des blocages SQLite et apprenez \u00e0 r\u00e9cup\u00e9rer les enregistrements supprim\u00e9s \u00e0 l'aide de techniques judiciaires.<\/p>","protected":false},"author":1,"featured_media":1271,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[21],"tags":[57],"class_list":["post-992","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mobile-forensics","tag-sqlite-databases"],"acf":[],"yoast_head":"\nRecovering Deleted Data from SQLite: Navigating the Freeblock Chain<\/title>\n<meta name=\"description\" content=\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/fr\/recuperation-des-donnees-supprimees-de-sqlite-navigation-dans-la-chaine-de-blocs-libres\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\" \/>\n<meta property=\"og:description\" content=\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/fr\/recuperation-des-donnees-supprimees-de-sqlite-navigation-dans-la-chaine-de-blocs-libres\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-28T20:09:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain-1024x574.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"574\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\",\"datePublished\":\"2024-11-28T20:09:37+00:00\",\"dateModified\":\"2025-07-18T18:04:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"},\"wordCount\":1036,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"keywords\":[\"SQLite Databases\"],\"articleSection\":[\"Mobile Forensics\"],\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\",\"name\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"datePublished\":\"2024-11-28T20:09:37+00:00\",\"dateModified\":\"2025-07-18T18:04:34+00:00\",\"description\":\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"width\":2912,\"height\":1632,\"caption\":\"Step-by-step guide to recovering deleted data from SQLite databases using the freeblock chain.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/fr\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"R\u00e9cup\u00e9ration de donn\u00e9es effac\u00e9es \u00e0 partir de SQLite : Naviguer dans la cha\u00eene de blocs libres","description":"Apprenez \u00e0 r\u00e9cup\u00e9rer les donn\u00e9es supprim\u00e9es des bases de donn\u00e9es SQLite en comprenant et en naviguant dans la cha\u00eene de blocs libres. Ce guide fournit aux enqu\u00eateurs judiciaires les techniques essentielles pour la r\u00e9cup\u00e9ration des donn\u00e9es.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/fr\/recuperation-des-donnees-supprimees-de-sqlite-navigation-dans-la-chaine-de-blocs-libres\/","og_locale":"fr_FR","og_type":"article","og_title":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain","og_description":"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.","og_url":"https:\/\/elusivedata.io\/fr\/recuperation-des-donnees-supprimees-de-sqlite-navigation-dans-la-chaine-de-blocs-libres\/","og_site_name":"Elusive Data","article_published_time":"2024-11-28T20:09:37+00:00","article_modified_time":"2025-07-18T18:04:34+00:00","og_image":[{"width":1024,"height":574,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain-1024x574.png","type":"image\/png"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_misc":{"\u00c9crit par":"James Eichbaum","Dur\u00e9e de lecture estim\u00e9e":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain","datePublished":"2024-11-28T20:09:37+00:00","dateModified":"2025-07-18T18:04:34+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"},"wordCount":1036,"commentCount":0,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","keywords":["SQLite Databases"],"articleSection":["Mobile Forensics"],"inLanguage":"fr-FR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","url":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","name":"R\u00e9cup\u00e9ration de donn\u00e9es effac\u00e9es \u00e0 partir de SQLite : Naviguer dans la cha\u00eene de blocs libres","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","datePublished":"2024-11-28T20:09:37+00:00","dateModified":"2025-07-18T18:04:34+00:00","description":"Apprenez \u00e0 r\u00e9cup\u00e9rer les donn\u00e9es supprim\u00e9es des bases de donn\u00e9es SQLite en comprenant et en naviguant dans la cha\u00eene de blocs libres. Ce guide fournit aux enqu\u00eateurs judiciaires les techniques essentielles pour la r\u00e9cup\u00e9ration des donn\u00e9es.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","width":2912,"height":1632,"caption":"Step-by-step guide to recovering deleted data from SQLite databases using the freeblock chain."},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain"}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"Donn\u00e9es insaisissables","description":"L'excellence en mati\u00e8re de formation et de conseil en criminalistique num\u00e9rique","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"Donn\u00e9es insaisissables","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/fr\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/posts\/992","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/comments?post=992"}],"version-history":[{"count":59,"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/posts\/992\/revisions"}],"predecessor-version":[{"id":1437,"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/posts\/992\/revisions\/1437"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/media\/1271"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/media?parent=992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/categories?post=992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/tags?post=992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}