{"id":992,"date":"2024-11-28T20:09:37","date_gmt":"2024-11-28T20:09:37","guid":{"rendered":"https:\/\/elusivedata.io\/?p=992"},"modified":"2025-07-18T18:04:34","modified_gmt":"2025-07-18T18:04:34","slug":"recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/pl\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","title":{"rendered":"Odzyskiwanie usuni\u0119tych danych z SQLite: Poruszanie si\u0119 po \u0142a\u0144cuchu Freeblock"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Wprowadzenie<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Bazy danych SQLite to skarbnice cyfrowych dowod\u00f3w znalezionych w wielu aplikacjach, od wiadomo\u015bci na czacie po dzienniki transakcji. Ale co si\u0119 dzieje, gdy rekordy s\u0105 usuwane? Enter freeblocki<\/em>-Ukryte sekcje nieu\u017cywanego miejsca na stronach bazy danych, kt\u00f3re zachowuj\u0105 pozosta\u0142o\u015bci usuni\u0119tych danych. Te wolne blokady s\u0105 kopalni\u0105 z\u0142ota dla \u015bledczych, umo\u017cliwiaj\u0105c odzyskiwanie krytycznych rekord\u00f3w i odkrywanie ukrytych dowod\u00f3w.<\/p>

Ten blog demistyfikuje wolne blokady SQLite, prowadz\u0105c Ci\u0119 przez spos\u00f3b ich dzia\u0142ania, jak je zlokalizowa\u0107 za pomoc\u0105 narz\u0119dzi takich jak edytory szesnastkowe i jak odzyska\u0107 usuni\u0119te rekordy. Niezale\u017cnie od tego, czy jeste\u015b \u015bledczym, czy entuzjast\u0105 kryminalistyki cyfrowej, ten przewodnik wyposa\u017cy Ci\u0119 w podstawowe techniki wydobywania ukrytych danych.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Czym s\u0105 Freeblocks w SQLite?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Freeblocks to sekcje niewykorzystanego miejsca na stronie bazy danych SQLite. Gdy rekord jest usuwany, odpowiadaj\u0105ca mu przestrze\u0144 nie jest natychmiast nadpisywana, chyba \u017ce w\u0142\u0105czony jest mechanizm bezpiecznego usuwania. Zamiast tego jest ona oznaczana jako freeblock<\/strong>dost\u0119pne dla przysz\u0142ych zapis\u00f3w.<\/p>\n

W tym procesie:<\/p>\n

    \n
  • Wska\u017anik do usuni\u0119tego rekordu jest usuwany.<\/li>\n
  • Nag\u0142\u00f3wek strony zostanie zaktualizowany, aby odzwierciedli\u0107 usuni\u0119cie.<\/li>\n
  • Je\u015bli ma to zastosowanie, przesuni\u0119cie wskazuj\u0105ce na pierwszy wolny blok jest dostosowywane.<\/li>\n<\/ul>\n

    \u00a0<\/p>\n

    Te wolne blokady cz\u0119sto zachowuj\u0105 pozosta\u0142o\u015bci oryginalnych danych, co czyni je krytycznym celem dla \u015bledczych, kt\u00f3rzy chc\u0105 odzyska\u0107 usuni\u0119te rekordy.<\/p>\n

    Przyk\u0142ad:<\/h4>\n

    Na poni\u017cszym zrzucie ekranu sprawdzamy baz\u0119 danych SQLite za pomoc\u0105 DB Browser. Tabela \"wiadomo\u015bci\" pokazuje dwa aktywne rekordy, ale wskaz\u00f3wki kryminalistyczne sugeruj\u0105 obecno\u015b\u0107 dodatkowych usuni\u0119tych rekord\u00f3w.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Jak Freeblocks mieszcz\u0105 si\u0119 w nag\u0142\u00f3wkach stron SQLite<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Aby zlokalizowa\u0107 i przeanalizowa\u0107 freeblocki, musimy najpierw zrozumie\u0107 struktur\u0119 stron bazy danych SQLite. Ka\u017cda strona zawiera nag\u0142\u00f3wek, kt\u00f3ry zapewnia krytyczne metadane, w tym wska\u017aniki do freeblock\u00f3w.<\/p>\n

    Poni\u017csza tabela przedstawia struktur\u0119 nag\u0142\u00f3wka dla strony typu 0D:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n
    Przesuni\u0119cie<\/th>\r\n Rozmiar<\/th>\r\n Opis<\/th>\r\n <\/tr>\r\n <\/thead>\r\n
    0<\/td>\r\n 1 bajt<\/td>\r\n Typ strony<\/td>\r\n <\/tr>\r\n
    1<\/td>\r\n 2 bajty<\/td>\r\n Przesuni\u0119cie bajtu do pierwszego wolnego bloku<\/strong><\/td>\r\n <\/tr>\r\n
    3<\/td>\r\n 2 bajty<\/td>\r\n Liczba kom\u00f3rek na stronie<\/td>\r\n <\/tr>\r\n
    5<\/td>\r\n 2 bajty<\/td>\r\n Przesuni\u0119cie do pierwszego bajtu zawarto\u015bci kom\u00f3rki<\/td>\r\n <\/tr>\r\n
    7<\/td>\r\n 1 bajt<\/td>\r\n Liczba pofragmentowanych wolnych bajt\u00f3w w kom\u00f3rkach<\/td>\r\n <\/tr>\r\n <\/tbody>\r\n<\/table>\r\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Kluczowy wniosek:<\/h4>\n

    Warto\u015b\u0107 w przesuni\u0119ciu 1 w nag\u0142\u00f3wku strony wskazuje na pierwszy wolny blok. Je\u015bli ta warto\u015b\u0107 to 0x0000<\/code>na stronie nie ma \u017cadnych darmowych blokad.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    U\u017cywanie edytor\u00f3w szesnastkowych do analizy freeblock\u00f3w<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Aby zlokalizowa\u0107 pierwszy freeblock, otwieramy baz\u0119 danych w edytorze szesnastkowym. Dwubajtowa warto\u015b\u0107 w offsecie 1 nag\u0142\u00f3wka strony zapewnia offset do lokalizacji freeblocka.<\/p>\n

    W poni\u017cszym przyk\u0142adzie:<\/p>\n

      \n
    • Edytor szesnastkowy pod\u015bwietla przesuni\u0119cie 0x03A9<\/code> (dziesi\u0119tnie 937) w kolorze czerwonym, kt\u00f3ry wskazuje lokalizacj\u0119 pierwszego wolnego bloku.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Przej\u015bcie do tego offsetu ujawnia pocz\u0105tek wolnego bloku. Poni\u017cej przeanalizujemy kom\u00f3rk\u0119 znajduj\u0105c\u0105 si\u0119 na offsecie 937.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Dekodowanie nag\u0142\u00f3wk\u00f3w Freeblock<\/h3>\n

      Ka\u017cdy freeblock zawiera czterobajtowy nag\u0142\u00f3wek:<\/p>\n

        \n
      1. Pierwsze 2 bajty<\/strong>: Przesuni\u0119cie do nast\u0119pnego wolnego bloku (0x0000<\/code> je\u015bli nie istnieje).<\/li>\n
      2. Drugie 2 bajty<\/strong>: Ca\u0142kowity rozmiar wolnego bloku, w tym sam nag\u0142\u00f3wek.<\/li>\n<\/ol>\n

        Przyk\u0142ad:<\/h4>\n

        Przy offsecie 0x03A9<\/code>, nag\u0142\u00f3wek freeblock wskazuje:<\/p>\n

          \n
        • Nast\u0119pny wolny blok znajduje si\u0119 na offsecie 0x03EA<\/code> (dziesi\u0119tnie 1002).<\/li>\n
        • Rozmiar wolnego bloku wynosi 0x0024<\/code> (36 bajt\u00f3w, \u0142\u0105cznie z nag\u0142\u00f3wkiem).<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
          \n\t\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t

          Odzyskiwanie usuni\u0119tych rekord\u00f3w przy u\u017cyciu Freeblocks<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
          \n\t\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t

          Freeblocki cz\u0119sto zawieraj\u0105 pozosta\u0142o\u015bci usuni\u0119tych rekord\u00f3w, umo\u017cliwiaj\u0105c \u015bledczym odzyskanie cz\u0119\u015bci lub ca\u0142o\u015bci danych. Na poni\u017cszym zrzucie ekranu \u0142adunek usuni\u0119tego rekordu jest nienaruszony i mo\u017cliwy do odzyskania pomimo usuni\u0119cia wska\u017anika.<\/p>\n

          Przyk\u0142ad:<\/h4>\n
            \n
          • Usuni\u0119ty rekord w offsecie 0x03A9<\/code> zawiera wiadomo\u015b\u0107: \"Niewiele. Jak si\u0119 masz?\"<\/li>\n
          • Kluczowe pola pozostaj\u0105 nienaruszone, w tym tre\u015b\u0107 wiadomo\u015bci, nawet je\u015bli inne metadane zosta\u0142y nadpisane.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
            \n\t\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
            \n\t\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t\t\t\t\t\t

            Analizujemy kolejne wolne blokady, aby odkry\u0107 dodatkowe usuni\u0119te rekordy. Przy offsecie 0x03EA<\/code>, nag\u0142\u00f3wek freeblock ujawnia:<\/p>\n

              \n
            • Rozmiar wolnego bloku wynosi 0x0016<\/code> (22 bajty).<\/li>\n
            • Jest to ostatni wolny blok w \u0142a\u0144cuchu, jak wskazuje symbol 0x0000<\/code> w nast\u0119pnym polu wska\u017anika wolnego bloku.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Poni\u017cszy zrzut ekranu podkre\u015bla ca\u0142y obszar kom\u00f3rki drugiego wolnego bloku w \u0142a\u0144cuchu, w kt\u00f3rym znajdowa\u0142a si\u0119 usuni\u0119ta wiadomo\u015b\u0107 \"Cze\u015b\u0107 Andy!\".<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t

              Identyfikacja dodatkowych usuni\u0119tych rekord\u00f3w<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Tak si\u0119 jednak sk\u0142ada, \u017ce na tej stronie znajduje si\u0119 jeszcze jeden usuni\u0119ty rekord, do kt\u00f3rego nie odwo\u0142uje si\u0119 \u0142a\u0144cuch freeblock. Patrz\u0105c wstecz na nag\u0142\u00f3wek strony, by\u0142y tylko 2 rekordy na tej stronie, zgodnie z dwubajtow\u0105 warto\u015bci\u0105 w offsecie 3 (0x00002<\/code>). A poniewa\u017c s\u0105 tylko 2 rekordy, w tablicy wska\u017anik\u00f3w s\u0105 tylko dwa wska\u017aniki. Te dwa wska\u017aniki wskazuj\u0105 na rekord #2 - \"Hej, co tam?\" i rekord #4 - \"Hej, zastanawia\u0142em si\u0119, czy masz jakiego\u015b Scooby snaxa\". Mo\u017cesz zauwa\u017cy\u0107, \u017ce w dalszej cz\u0119\u015bci strony znajduje si\u0119 kolejna d\u0142uga wiadomo\u015b\u0107.<\/p>\n

              Dwubajtowa warto\u015b\u0107 w przesuni\u0119ciu 5 w nag\u0142\u00f3wku strony jest przesuni\u0119ciem do obszaru zawarto\u015bci kom\u00f3rki, czyli zasadniczo tam, gdzie zostanie zapisany nast\u0119pny rekord, chyba \u017ce zmie\u015bci si\u0119 on w jednym z wolnych blok\u00f3w. Ta warto\u015b\u0107 to 0x0363<\/code> co jest przesuni\u0119ciem dziesi\u0119tnym 867.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Strza\u0142ka na powy\u017cszym zrzucie ekranu wskazuje przesuni\u0119cie strony 867. Jest to pocz\u0105tek zawarto\u015bci kom\u00f3rki, co oznacza, \u017ce nast\u0119pny rekord zostanie dodany tu\u017c nad tym rekordem. Usuni\u0119ty rekord powy\u017cej zawiera wiadomo\u015b\u0107: \"Zdarzy\u0142o mi si\u0119 otrzyma\u0107 now\u0105 dostaw\u0119 zesz\u0142ej nocy. Masz szcz\u0119\u015bcie. Ile potrzebujesz?\".<\/p>\n

              Baza danych traktuje te dane jako nieprzydzielone miejsce. R\u00f3wnie dobrze mo\u017cna j\u0105 wype\u0142ni\u0107 0x00<\/code> poniewa\u017c w tablicy wska\u017anik\u00f3w nie ma wska\u017anika, kt\u00f3ry by go adresowa\u0142.\u00a0

              Je\u015bli rekord, kt\u00f3ry jest zbyt du\u017cy, aby zmie\u015bci\u0107 si\u0119 w dw\u00f3ch wolnych blokach na stronie, zostanie dodany do tabeli, do kt\u00f3rej nale\u017cy ta strona, nadpisze on wiadomo\u015b\u0107, kt\u00f3r\u0105 jest rekord #5.\u00a0<\/p>\n

              Zobaczmy, jak to wygl\u0105da teraz, gdy zidentyfikowali\u015bmy dwie wolne blokady wraz z trzecim usuni\u0119tym rekordem, kt\u00f3ry czeka na nadpisanie:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Po przeanalizowaniu bazy danych w jej nieprzetworzonym formacie mo\u017cemy stwierdzi\u0107, \u017ce zawiera\u0142a ona wi\u0119cej ni\u017c tylko 2 rekordy \"na \u017cywo\", kt\u00f3re wy\u015bwietla\u0142a przegl\u0105darka bazy danych.\u00a0<\/p>\n

              Nagranie #1 by\u0142o prawdopodobnie wiadomo\u015bci\u0105 \"Cze\u015b\u0107 Andy!\", podczas gdy nagranie #3 by\u0142o prawdopodobnie wiadomo\u015bci\u0105 \"Niewiele. Jak si\u0119 masz?\". Rekord #5 nadal ma sw\u00f3j numer rekordu w kom\u00f3rce zidentyfikowanej jako wiadomo\u015b\u0107: \"Tak si\u0119 sk\u0142ada, \u017ce ostatniej nocy dosta\u0142em now\u0105 dostaw\u0119. Masz szcz\u0119\u015bcie. Ile potrzebujesz?\".<\/p>\n

              \u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t

              Wnioski<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Freeblocki s\u0105 pot\u0119\u017cnym narz\u0119dziem w dochodzeniach kryminalistycznych, oferuj\u0105c wgl\u0105d w usuni\u0119te rekordy i nieprzydzielone dane. Opanowuj\u0105c te techniki, \u015bledczy mog\u0105 odkry\u0107 cyfrowe \u015blady pozostawione przez bazy danych.<\/p>

              Chcesz przenie\u015b\u0107 swoje umiej\u0119tno\u015bci w zakresie analizy \u015bledczej SQLite na wy\u017cszy poziom? Zapoznaj si\u0119 z naszymi zaawansowanymi programami szkoleniowymi lub skontaktuj si\u0119 z nami, aby dowiedzie\u0107 si\u0119, w jaki spos\u00f3b mo\u017cemy pom\u00f3c Ci zosta\u0107 ekspertem medycyny s\u0105dowej.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

              Odkryj sekrety freeblock\u00f3w SQLite i dowiedz si\u0119, jak odzyska\u0107 usuni\u0119te rekordy za pomoc\u0105 technik kryminalistycznych.<\/p>","protected":false},"author":1,"featured_media":1271,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[21],"tags":[57],"class_list":["post-992","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mobile-forensics","tag-sqlite-databases"],"acf":[],"yoast_head":"\nRecovering Deleted Data from SQLite: Navigating the Freeblock Chain<\/title>\n<meta name=\"description\" content=\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/pl\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/\" \/>\n<meta property=\"og:locale\" content=\"pl_PL\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\" \/>\n<meta property=\"og:description\" content=\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/pl\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-28T20:09:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain-1024x574.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"574\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Napisane przez\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Szacowany czas czytania\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minut\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\",\"datePublished\":\"2024-11-28T20:09:37+00:00\",\"dateModified\":\"2025-07-18T18:04:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"},\"wordCount\":1036,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"keywords\":[\"SQLite Databases\"],\"articleSection\":[\"Mobile Forensics\"],\"inLanguage\":\"pl-PL\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\",\"name\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"datePublished\":\"2024-11-28T20:09:37+00:00\",\"dateModified\":\"2025-07-18T18:04:34+00:00\",\"description\":\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#breadcrumb\"},\"inLanguage\":\"pl-PL\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pl-PL\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"width\":2912,\"height\":1632,\"caption\":\"Step-by-step guide to recovering deleted data from SQLite databases using the freeblock chain.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pl-PL\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pl-PL\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pl-PL\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/pl\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Odzyskiwanie usuni\u0119tych danych z SQLite: Poruszanie si\u0119 po \u0142a\u0144cuchu Freeblock","description":"Dowiedz si\u0119, jak odzyska\u0107 usuni\u0119te dane z baz danych SQLite poprzez zrozumienie i poruszanie si\u0119 po \u0142a\u0144cuchu freeblock. Ten przewodnik zapewnia \u015bledczym podstawowe techniki odzyskiwania danych.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/pl\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","og_locale":"pl_PL","og_type":"article","og_title":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain","og_description":"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.","og_url":"https:\/\/elusivedata.io\/pl\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","og_site_name":"Elusive Data","article_published_time":"2024-11-28T20:09:37+00:00","article_modified_time":"2025-07-18T18:04:34+00:00","og_image":[{"width":1024,"height":574,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain-1024x574.png","type":"image\/png"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_misc":{"Napisane przez":"James Eichbaum","Szacowany czas czytania":"7 minut"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain","datePublished":"2024-11-28T20:09:37+00:00","dateModified":"2025-07-18T18:04:34+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"},"wordCount":1036,"commentCount":0,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","keywords":["SQLite Databases"],"articleSection":["Mobile Forensics"],"inLanguage":"pl-PL","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","url":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","name":"Odzyskiwanie usuni\u0119tych danych z SQLite: Poruszanie si\u0119 po \u0142a\u0144cuchu Freeblock","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","datePublished":"2024-11-28T20:09:37+00:00","dateModified":"2025-07-18T18:04:34+00:00","description":"Dowiedz si\u0119, jak odzyska\u0107 usuni\u0119te dane z baz danych SQLite poprzez zrozumienie i poruszanie si\u0119 po \u0142a\u0144cuchu freeblock. Ten przewodnik zapewnia \u015bledczym podstawowe techniki odzyskiwania danych.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#breadcrumb"},"inLanguage":"pl-PL","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"]}]},{"@type":"ImageObject","inLanguage":"pl-PL","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","width":2912,"height":1632,"caption":"Step-by-step guide to recovering deleted data from SQLite databases using the freeblock chain."},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain"}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"ElusiveData","description":"Doskona\u0142o\u015b\u0107 w zakresie szkole\u0144 i doradztwa w dziedzinie informatyki \u015bledczej","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pl-PL"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"ElusiveData","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"pl-PL","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"pl-PL","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/pl\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/posts\/992","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/comments?post=992"}],"version-history":[{"count":59,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/posts\/992\/revisions"}],"predecessor-version":[{"id":1437,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/posts\/992\/revisions\/1437"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/media\/1271"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/media?parent=992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/categories?post=992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/tags?post=992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}