{"id":992,"date":"2024-11-28T20:09:37","date_gmt":"2024-11-28T20:09:37","guid":{"rendered":"https:\/\/elusivedata.io\/?p=992"},"modified":"2025-07-18T18:04:34","modified_gmt":"2025-07-18T18:04:34","slug":"recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/nb\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","title":{"rendered":"Gjenopprette slettede data fra SQLite: Navigere i freeblock-kjeden"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Innledning<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

SQLite-databaser er skattekister med digitale bevis som finnes i mange apper, fra chat-meldinger til transaksjonslogger. Men hva skjer n\u00e5r poster slettes? G\u00e5 inn i Freeblocks<\/em>-skjulte deler av ubrukt plass p\u00e5 databasesider som inneholder rester av slettede data. Disse freeblockene er en gullgruve for kriminalteknikere, og gj\u00f8r det mulig \u00e5 gjenopprette kritiske poster og avdekke skjulte bevis.<\/p>

Denne bloggen avmystifiserer SQLite-freeblocks og g\u00e5r gjennom hvordan de fungerer, hvordan du finner dem med verkt\u00f8y som hex-editorer, og hvordan du gjenoppretter slettede poster. Enten du er etterforsker eller en entusiast innen digital kriminalteknikk, vil denne guiden utstyre deg med viktige teknikker for \u00e5 hente ut skjulte data.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Hva er Freeblocks i SQLite?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Freeblocks er deler av ubrukt plass p\u00e5 en SQLite-databaseside. N\u00e5r en post slettes, overskrives ikke den tilsvarende plassen umiddelbart med mindre en sikker slettingsmekanisme er aktivert. I stedet blir den merket som en freeblock<\/strong>, tilgjengelig for fremtidige skriverier.<\/p>\n

I denne prosessen<\/p>\n

    \n
  • Pekeren til den slettede posten fjernes.<\/li>\n
  • Sidetoppteksten oppdateres for \u00e5 gjenspeile fjerningen.<\/li>\n
  • Hvis det er aktuelt, justeres forskyvningen som peker mot den f\u00f8rste friblokken.<\/li>\n<\/ul>\n

    \u00a0<\/p>\n

    Disse freeblockene inneholder ofte rester av de opprinnelige dataene, noe som gj\u00f8r dem til et kritisk fokus for rettsmedisinske etterforskere som \u00f8nsker \u00e5 gjenopprette slettede oppf\u00f8ringer.<\/p>\n

    Eksempel:<\/h4>\n

    I skjermbildet nedenfor unders\u00f8ker vi en SQLite-database ved hjelp av DB Browser. Tabellen \"messages\" viser to aktive poster, men kriminaltekniske spor tyder p\u00e5 at det finnes flere slettede poster.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Hvordan Freeblocks passer inn i SQLite-sideoverskrifter<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    For \u00e5 finne og analysere freeblocks m\u00e5 vi f\u00f8rst forst\u00e5 strukturen til SQLite-databasesidene. Hver side inneholder en topptekst som inneholder viktige metadata, inkludert pekere til freeblocks.<\/p>\n

    Tabellen nedenfor viser topptekststrukturen for en 0D-sidetype:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n
    Offset<\/th>\r\n St\u00f8rrelse<\/th>\r\n Beskrivelse<\/th>\r\n <\/tr>\r\n <\/thead>\r\n
    0<\/td>\r\n 1 byte<\/td>\r\n Sidetype<\/td>\r\n <\/tr>\r\n
    1<\/td>\r\n 2 Bytes<\/td>\r\n Byteoffset til den f\u00f8rste friblokken<\/strong><\/td>\r\n <\/tr>\r\n
    3<\/td>\r\n 2 Bytes<\/td>\r\n Antall celler p\u00e5 siden<\/td>\r\n <\/tr>\r\n
    5<\/td>\r\n 2 Bytes<\/td>\r\n Offset til f\u00f8rste byte av celleinnholdet<\/td>\r\n <\/tr>\r\n
    7<\/td>\r\n 1 byte<\/td>\r\n Antall fragmenterte frie byte i celler<\/td>\r\n <\/tr>\r\n <\/tbody>\r\n<\/table>\r\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Det viktigste \u00e5 ta med seg:<\/h4>\n

    Verdien ved offset 1 i sidehodet peker til den f\u00f8rste friblokken. Hvis denne verdien er 0x0000<\/code>er det ingen freeblocks p\u00e5 siden.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Bruke hex-editorer til \u00e5 analysere friblokker<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    For \u00e5 finne den f\u00f8rste friblokken \u00e5pner vi databasen i en hex-editor. Den to byte store verdien ved offset 1 i sideoverskriften gir offset til friblokkens plassering.<\/p>\n

    I eksempelet nedenfor:<\/p>\n

      \n
    • Hex-redigeringsprogrammet fremhever offset 0x03A9<\/code> (desimal 937) i r\u00f8dt, som peker p\u00e5 plasseringen av den f\u00f8rste friblokken.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Ved \u00e5 navigere til denne forskyvningen finner du starten p\u00e5 friblokken. Nedenfor unders\u00f8ker vi cellen som ligger ved offset 937.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Dekoding av Freeblock-overskrifter<\/h3>\n

      Hver friblokk inneholder en header p\u00e5 fire byte som best\u00e5r av<\/p>\n

        \n
      1. De to f\u00f8rste byte<\/strong>: Offset til neste friblokk (0x0000<\/code> hvis det ikke finnes noen).<\/li>\n
      2. Andre 2 byte<\/strong>: Total st\u00f8rrelse p\u00e5 friblokken, inkludert selve overskriften.<\/li>\n<\/ol>\n

        Eksempel:<\/h4>\n

        Ved forskyvning 0x03A9<\/code>, indikerer friblokkhodet:<\/p>\n

          \n
        • Neste friblokk er ved offset 0x03EA<\/code> (desimal 1002).<\/li>\n
        • St\u00f8rrelsen p\u00e5 friblokken er 0x0024<\/code> (36 byte, inkludert topptekst).<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
          \n\t\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t

          Gjenopprette slettede poster ved hjelp av Freeblocks<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
          \n\t\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t

          Freeblocks inneholder ofte rester av slettede poster, noe som gj\u00f8r det mulig for kriminalteknikere \u00e5 gjenopprette deler av eller hele data. I skjermbildet nedenfor er nyttelasten til en slettet post intakt og kan gjenopprettes til tross for at pekeren er fjernet.<\/p>\n

          Eksempel:<\/h4>\n
            \n
          • Den slettede posten ved offset 0x03A9<\/code> inneholder beskjeden: \"Ikke mye. Hvordan g\u00e5r det med deg?\"<\/li>\n
          • N\u00f8kkelfelter forblir intakte, inkludert meldingsinnholdet, selv om andre metadata har blitt overskrevet.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
            \n\t\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
            \n\t\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t\t\t\t\t\t

            Vi analyserer p\u00e5f\u00f8lgende freeblocks for \u00e5 avdekke flere slettede poster. Ved offset 0x03EA<\/code>avsl\u00f8rer freeblock-toppteksten:<\/p>\n

              \n
            • St\u00f8rrelsen p\u00e5 friblokken er 0x0016<\/code> (22 byte).<\/li>\n
            • Dette er den siste friblokken i kjeden, som indikert av 0x0000<\/code> i det neste friblokk-pekerfeltet.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Skjermbildet nedenfor viser hele celleomr\u00e5det i den andre friblokken i kjeden, der den slettede meldingen var \"Hi Andy!\"<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t

              Identifisere flere slettede poster<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Men det er tilfeldigvis \u00e9n slettet post til p\u00e5 denne siden som ikke er referert til av freeblock-kjeden. Hvis vi ser tilbake p\u00e5 sidehodet, var det bare to poster p\u00e5 denne siden i henhold til to-byte-verdien ved offset 3 (0x00002<\/code>). Og siden det bare er to poster, er det bare to pekere i pekerarrayen. Disse to pekerne peker til post #2 - \"Hei, hva skjer?\" og post #4 - \"Hei, jeg lurte p\u00e5 om du har noen Scooby Snax.\" Du vil kanskje legge merke til at det ligger en annen lang melding lenger opp p\u00e5 siden.<\/p>\n

              Den to byte store verdien ved offset 5 i sidehodet er offset til cellens innholdsomr\u00e5de, der neste post vil bli skrevet, med mindre den f\u00e5r plass i en av friblokkene. Denne verdien er 0x0363<\/code> som er desimal offset 867.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Pilen i skjermbildet ovenfor peker til sideoffset 867. Dette er starten p\u00e5 celleinnholdet, noe som betyr at neste post vil bli lagt til rett over denne posten. Den slettede posten over denne inneholder meldingen \"Jeg fikk tilfeldigvis inn en ny leveranse i g\u00e5r kveld. Du har flaks. Hvor mye trenger du?\"<\/p>\n

              Databasen anser disse dataene som uallokert plass. Den kan like gjerne fylles med 0x00<\/code> siden det ikke finnes noen peker i pekerarrayen som adresserer den.\u00a0

              Hvis det legges til en post som er for stor til \u00e5 f\u00e5 plass innenfor de to friblokkene p\u00e5 siden, vil den overskrive meldingen, som tilfeldigvis er post #5.\u00a0<\/p>\n

              La oss se hvordan det ser ut n\u00e5 som vi har identifisert de to freeblockene sammen med den tredje slettede posten som venter p\u00e5 \u00e5 bli overskrevet:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Etter \u00e5 ha analysert databasen i r\u00e5format, kan vi konkludere med at den inneholdt mer enn bare de to \"live\"-postene som databasevisningen viste.\u00a0<\/p>\n

              Opptak #1 var sannsynligvis meldingen \"Hei Andy!\", mens opptak #3 sannsynligvis var meldingen \"Ikke mye. Hvordan har du det?\". Record #5 har fortsatt sitt recordnummer i cellen som er identifisert som meldingen \"Jeg fikk tilfeldigvis inn en ny forsyning i g\u00e5r kveld. Du har flaks. Hvor mye trenger du?\"<\/p>\n

              \u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t

              Konklusjon<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Freeblocks er et kraftfullt verkt\u00f8y i kriminaltekniske unders\u00f8kelser, og gir innsyn i slettede poster og data som ikke er allokert. Ved \u00e5 beherske disse teknikkene kan etterforskere avdekke de digitale sporene som databaser etterlater seg.<\/p>

              Er du klar for \u00e5 ta SQLite-etterforskningskunnskapene dine til neste niv\u00e5? Utforsk v\u00e5re avanserte oppl\u00e6ringsprogrammer, eller kontakt oss for \u00e5 finne ut hvordan vi kan hjelpe deg med \u00e5 bli en kriminalteknisk ekspert.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

              Avsl\u00f8r hemmelighetene bak SQLite freeblocks, og l\u00e6r hvordan du gjenoppretter slettede poster ved hjelp av kriminaltekniske teknikker.<\/p>","protected":false},"author":1,"featured_media":1271,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[21],"tags":[57],"class_list":["post-992","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mobile-forensics","tag-sqlite-databases"],"acf":[],"yoast_head":"\nRecovering Deleted Data from SQLite: Navigating the Freeblock Chain<\/title>\n<meta name=\"description\" content=\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/nb\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/\" \/>\n<meta property=\"og:locale\" content=\"nb_NO\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\" \/>\n<meta property=\"og:description\" content=\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/nb\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-28T20:09:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain-1024x574.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"574\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Skrevet av\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Ansl. lesetid\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutter\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\",\"datePublished\":\"2024-11-28T20:09:37+00:00\",\"dateModified\":\"2025-07-18T18:04:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"},\"wordCount\":1036,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"keywords\":[\"SQLite Databases\"],\"articleSection\":[\"Mobile Forensics\"],\"inLanguage\":\"nb-NO\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\",\"name\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"datePublished\":\"2024-11-28T20:09:37+00:00\",\"dateModified\":\"2025-07-18T18:04:34+00:00\",\"description\":\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#breadcrumb\"},\"inLanguage\":\"nb-NO\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"nb-NO\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"width\":2912,\"height\":1632,\"caption\":\"Step-by-step guide to recovering deleted data from SQLite databases using the freeblock chain.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"nb-NO\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nb-NO\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nb-NO\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/nb\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Gjenopprette slettede data fra SQLite: Navigere i freeblock-kjeden","description":"L\u00e6r hvordan du gjenoppretter slettede data fra SQLite-databaser ved \u00e5 forst\u00e5 og navigere i freeblock-kjeden. Denne veiledningen gir kriminalteknikere viktige teknikker for datagjenoppretting.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/nb\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","og_locale":"nb_NO","og_type":"article","og_title":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain","og_description":"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.","og_url":"https:\/\/elusivedata.io\/nb\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","og_site_name":"Elusive Data","article_published_time":"2024-11-28T20:09:37+00:00","article_modified_time":"2025-07-18T18:04:34+00:00","og_image":[{"width":1024,"height":574,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain-1024x574.png","type":"image\/png"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_misc":{"Skrevet av":"James Eichbaum","Ansl. lesetid":"7 minutter"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain","datePublished":"2024-11-28T20:09:37+00:00","dateModified":"2025-07-18T18:04:34+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"},"wordCount":1036,"commentCount":0,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","keywords":["SQLite Databases"],"articleSection":["Mobile Forensics"],"inLanguage":"nb-NO","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","url":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","name":"Gjenopprette slettede data fra SQLite: Navigere i freeblock-kjeden","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","datePublished":"2024-11-28T20:09:37+00:00","dateModified":"2025-07-18T18:04:34+00:00","description":"L\u00e6r hvordan du gjenoppretter slettede data fra SQLite-databaser ved \u00e5 forst\u00e5 og navigere i freeblock-kjeden. Denne veiledningen gir kriminalteknikere viktige teknikker for datagjenoppretting.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#breadcrumb"},"inLanguage":"nb-NO","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"]}]},{"@type":"ImageObject","inLanguage":"nb-NO","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","width":2912,"height":1632,"caption":"Step-by-step guide to recovering deleted data from SQLite databases using the freeblock chain."},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain"}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"ElusiveData","description":"Fremragende oppl\u00e6ring og r\u00e5dgivning innen digital etterforskning","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"nb-NO"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"ElusiveData","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"nb-NO","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"nb-NO","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/nb\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/posts\/992","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/comments?post=992"}],"version-history":[{"count":59,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/posts\/992\/revisions"}],"predecessor-version":[{"id":1437,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/posts\/992\/revisions\/1437"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/media\/1271"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/media?parent=992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/categories?post=992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/tags?post=992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}