Elusive Data digital forensics training

SQLite Overflow Pages: How Digital Forensics Recovers Hidden Data

Introduction: The Puzzle of Overflow Pages

Imagine buying a poster that’s too big for the frames you have at home. To display it properly, you’d need to cut it into sections so it fits within the available frames. The same principle applies to SQLite databases when handling large records—they break them into parts and store them across multiple pages. This is where overflow pages come in.

Overflow pages store data that doesn’t fit within a single SQLite database page (typically 4,096 bytes). These pages are linked together, forming a chain that forensic analysts must reconstruct to recover complete data. If analysts fail to follow the overflow structure, they risk retrieving incomplete or corrupted evidence.

In this article, we’ll explore how overflow pages work, why they matter in forensic investigations, and how to extract fragmented data step by step.

What Are Overflow Pages in SQLite?

SQLite databases allocate a fixed page size (e.g., 4,096 bytes). However, when a record—such as an image stored as a BLOB (Binary Large Object)—exceeds this size, the excess data spills over into overflow pages.

Key Takeaways:

✅ Overflow pages prevent large records from monopolizing a single page.
✅ They’re linked in a chain, starting from the main page.
✅ Forensic analysts must reconstruct these chains to retrieve complete data.

Understanding how overflow pages work is essential for forensic investigations.

High-Level Overview: How Overflow Pages Work

To illustrate the concept of overflow pages, let’s look at the following examples:

1. Fragmented Image Representation

Darth Vader frames in SQLite BLOB — forensic image carving from database tutorial
Illustration of fragmented data storage in SQLite: A large image is split across multiple frames, representing how overflow pages handle large BLOBs.

This visualization represents how large BLOBs, such as images, are stored in SQLite. The image is broken into multiple sections, just as an overflow page stores fragmented data.

2. Data Stored on a Single Page

Full frame SQLite BLOB image — forensic recovery of complete image from database
An F-16 jet image fully stored within a single SQLite page, demonstrating an ideal case where overflow pages are not needed.

Here, an image fits entirely within one database page, eliminating the need for overflow pages.

3. Data Split Across Multiple Pages

Chain in orange — digital forensics investigation scenario evidence image
Hex representation of an image stored non-contiguously across SQLite pages 7, 3, and 5, requiring forensic reconstruction.

This example illustrates how data is stored in a non-contiguous manner, requiring forensic analysis to reconstruct it correctly.

4. Reconstructing Data from Overflow Pages

Firearm image attachment — digital forensics mobile evidence in SQLite training scenario
A successfully reconstructed image from fragmented SQLite pages, illustrating the forensic process of overflow page retrieval.

Following overflow page pointers allows forensic analysts to reassemble fragmented data.

Forensic Importance of Overflow Pages

Many messaging apps, mobile applications, and databases store user profile pictures, chat logs, and attachments in SQLite. When images and documents span multiple pages, forensic examiners must understand overflow structures to extract the data properly.

Forensic Challenges:

  • Fragmented Data: BLOBs (such as images) are often split across multiple pages.
  • Pointer-Based Retrieval: Analysts must follow SQLite’s overflow page pointers to reconstruct the full image or file.
  • Carving Issues: Simply searching for a JPEG header (FFD8FF) and footer (FFD9) may fail because they may exist on separate pages.

Real-World Example: Extracting a Profile Picture from Overflow Pages

Now, let’s walk through a step-by-step forensic recovery of an image stored in an SQLite database.

Locate the BLOB in the Database

DB Viewer contacts table with BLOB data — forensic SQLite database examination
DB Browser for SQLite showing a contacts table with profile pictures stored as BLOBs, an essential step in forensic extraction.

Using DB Browser for SQLite, forensic analysts identify the record containing the profile picture in the contacts table.

Identify the BLOB Length in Hex

SQLite Ali record forensic analysis — examining database record structure and BLOB data
Varint 0xB135 converts to a cell length of 6,325 bytes (Not including the varint itself or the Row ID)

Using HxD, a hex editor, they locate the record header, which contains a VARINT that determines the BLOB length.

Confirm the Image Size

SQLite Ali record BLOB length — forensic analysis of image BLOB size in database
Highlighted VARINT in HxD showing the total image size (6,325 bytes), confirming it exceeds the standard SQLite page size.

The second VARINT in the record header specifies the image’s size. In this case, the total size is 6,325 bytes, exceeding the page limit.

Follow the Overflow Pointer

JPEG Part 1 highlighted in SQLite — forensic analysis of image BLOB header bytes
SQLite overflow pointer at the bottom of the page, directing the data continuation to page 4 for further retrieval.

At the bottom of the main page, a four-byte pointer leads to page 4, which contains the next portion of the image.

Examine the Overflow Page

SQLite page 4 overflow — forensic analysis of SQLite overflow page structure
Hex view of a fragmented image fully highlighted, ready for manual extraction and forensic reconstruction.

The first four bytes on page 4 indicate whether another overflow page follows. Since the value is 0x00000000, this is the last overflow page.

Extract and Reconstruct the Image

Carved image from SQLite BLOB — forensic file carving technique for image recovery
Hex view of a fragmented image fully highlighted, ready for manual extraction and forensic reconstruction.

Forensic analysts extract the 6,292 bytes of the image from both pages and manually reconstruct it.

📌The four-byte pointers are NOT part of the data to be included in the carved image

Verify the Recovered Image

Digital forensics training image — Elusive Data DFIR course content
Extracted imageRecovered profile picture from SQLite overflow pages, successfully carved and displayed in Windows Photo Viewer.

The extracted image is now fully restored and viewable.

Final Thoughts: The Importance of Overflow Page Analysis

In forensic investigations, overlooking overflow pages can lead to critical evidence loss. Understanding SQLite’s storage mechanism is crucial for accurate data extraction and reconstruction.

Key Forensic Insights:

✔️ Always check for overflow pageswhen analyzing large records.

✔️ Follow SQLite’s overflow pointerscarefully.

✔️ Simple file carving techniques may not work due to non-contiguous storage.

Whether analyzing chat databases, contact lists, or application logs, forensic professionals must be proficient in recovering fragmented data.

💡 Have you encountered fragmented data in SQLite forensics? How do you approach overflow page analysis? Share your insights below!

Facebook
Twitter
Email
Print
Picture of James Eichbaum
James Eichbaum

Subscribe to stay updated!

Never miss a post – get notified whenever we publish a new blog article, forensic guide, or share important updates.

Latest Post