{"id":992,"date":"2024-11-28T20:09:37","date_gmt":"2024-11-28T20:09:37","guid":{"rendered":"https:\/\/elusivedata.io\/?p=992"},"modified":"2025-07-18T18:04:34","modified_gmt":"2025-07-18T18:04:34","slug":"recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/pt\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","title":{"rendered":"Recupera\u00e7\u00e3o de dados eliminados do SQLite: Navegando na cadeia de blocos livres"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Introdu\u00e7\u00e3o<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

As bases de dados SQLite s\u00e3o tesouros de provas digitais que se encontram em muitas aplica\u00e7\u00f5es, desde mensagens de conversa\u00e7\u00e3o a registos de transac\u00e7\u00f5es. Mas o que acontece quando os registos s\u00e3o eliminados? Introduzir bloqueios livres<\/em>-sec\u00e7\u00f5es ocultas de espa\u00e7o n\u00e3o utilizado nas p\u00e1ginas da base de dados que ret\u00eam vest\u00edgios de dados eliminados. Estes freeblocks s\u00e3o uma mina de ouro para os investigadores forenses, permitindo a recupera\u00e7\u00e3o de registos cr\u00edticos e a descoberta de provas ocultas.<\/p>

Este blogue desmistifica os freeblocks do SQLite, explicando-lhe como funcionam, como localiz\u00e1-los com ferramentas como os editores hexadecimais e como recuperar registos eliminados. Quer seja um investigador ou um entusiasta da investiga\u00e7\u00e3o forense digital, este guia fornecer-lhe-\u00e1 as t\u00e9cnicas essenciais para extrair dados ocultos.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

O que s\u00e3o Freeblocks no SQLite?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Os freeblocks s\u00e3o sec\u00e7\u00f5es de espa\u00e7o n\u00e3o utilizado numa p\u00e1gina de uma base de dados SQLite. Quando um registo \u00e9 apagado, o espa\u00e7o correspondente n\u00e3o \u00e9 imediatamente substitu\u00eddo, a menos que um mecanismo de apagamento seguro esteja ativado. Em vez disso, ele \u00e9 marcado como um freeblock<\/strong>dispon\u00edvel para futuras escritas.<\/p>\n

Neste processo:<\/p>\n

    \n
  • O ponteiro para o registo eliminado \u00e9 removido.<\/li>\n
  • O cabe\u00e7alho da p\u00e1gina \u00e9 atualizado para refletir a remo\u00e7\u00e3o.<\/li>\n
  • Se aplic\u00e1vel, o desvio que aponta para o primeiro bloco livre \u00e9 ajustado.<\/li>\n<\/ul>\n

    \u00a0<\/p>\n

    Estes freeblocks ret\u00eam frequentemente vest\u00edgios dos dados originais, o que os torna um foco cr\u00edtico para os investigadores forenses que pretendem recuperar registos eliminados.<\/p>\n

    Exemplo:<\/h4>\n

    Na captura de ecr\u00e3 abaixo, examinamos uma base de dados SQLite utilizando o DB Browser. A tabela \"messages\" mostra dois registos activos, mas as pistas forenses sugerem a presen\u00e7a de registos adicionais eliminados.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Como os Freeblocks se encaixam nos cabe\u00e7alhos de p\u00e1gina do SQLite<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Para localizar e analisar freeblocks, precisamos primeiro de compreender a estrutura das p\u00e1ginas da base de dados SQLite. Cada p\u00e1gina cont\u00e9m um cabe\u00e7alho que fornece metadados cr\u00edticos, incluindo ponteiros para freeblocks.<\/p>\n

    O quadro seguinte apresenta a estrutura do cabe\u00e7alho para um tipo de p\u00e1gina 0D:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n
    Desvio<\/th>\r\n Tamanho<\/th>\r\n Descri\u00e7\u00e3o<\/th>\r\n <\/tr>\r\n <\/thead>\r\n
    0<\/td>\r\n 1 Byte<\/td>\r\n Tipo de p\u00e1gina<\/td>\r\n <\/tr>\r\n
    1<\/td>\r\n 2 Bytes<\/td>\r\n Desloca\u00e7\u00e3o de bytes para o primeiro bloco livre<\/strong><\/td>\r\n <\/tr>\r\n
    3<\/td>\r\n 2 Bytes<\/td>\r\n N\u00famero de c\u00e9lulas na p\u00e1gina<\/td>\r\n <\/tr>\r\n
    5<\/td>\r\n 2 Bytes<\/td>\r\n Desloca\u00e7\u00e3o para o primeiro byte do conte\u00fado da c\u00e9lula<\/td>\r\n <\/tr>\r\n
    7<\/td>\r\n 1 Byte<\/td>\r\n N\u00famero de bytes livres fragmentados em c\u00e9lulas<\/td>\r\n <\/tr>\r\n <\/tbody>\r\n<\/table>\r\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Principais conclus\u00f5es:<\/h4>\n

    O valor no offset 1 no cabe\u00e7alho da p\u00e1gina aponta para o primeiro bloco livre. Se este valor for 0x0000<\/code>n\u00e3o h\u00e1 bloqueios gratuitos na p\u00e1gina.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Usando Editores Hexadecimais para Analisar Freeblocks<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Para localizar o primeiro freeblock, abrimos a base de dados num editor hexadecimal. O valor de dois bytes no offset 1 do cabe\u00e7alho da p\u00e1gina fornece o offset para a localiza\u00e7\u00e3o do freeblock.<\/p>\n

    No exemplo abaixo:<\/p>\n

      \n
    • O editor hexadecimal destaca o deslocamento 0x03A9<\/code> (decimal 937) a vermelho, que indica a localiza\u00e7\u00e3o do primeiro bloco livre.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Navegar para este offset revela o in\u00edcio do bloco livre. De seguida, examinamos a c\u00e9lula situada no desvio 937.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Descodifica\u00e7\u00e3o de cabe\u00e7alhos Freeblock<\/h3>\n

      Cada freeblock cont\u00e9m um cabe\u00e7alho de quatro bytes que inclui:<\/p>\n

        \n
      1. Primeiros 2 bytes<\/strong>: Desvio para o bloco livre seguinte (0x0000<\/code> se n\u00e3o existir nenhum).<\/li>\n
      2. Segundo 2 bytes<\/strong>: Tamanho total do bloco livre, incluindo o pr\u00f3prio cabe\u00e7alho.<\/li>\n<\/ol>\n

        Exemplo:<\/h4>\n

        No desvio 0x03A9<\/code>O cabe\u00e7alho do bloco livre indica:<\/p>\n

          \n
        • O pr\u00f3ximo bloco livre est\u00e1 em offset 0x03EA<\/code> (decimal 1002).<\/li>\n
        • O tamanho do bloco livre \u00e9 0x0024<\/code> (36 bytes, incluindo o cabe\u00e7alho).<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
          \n\t\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t

          Recupera\u00e7\u00e3o de registos eliminados utilizando Freeblocks<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
          \n\t\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t

          Os freeblocks cont\u00eam frequentemente restos de registos eliminados, permitindo aos investigadores forenses recuperar dados parciais ou completos. Na captura de ecr\u00e3 abaixo, a carga \u00fatil de um registo eliminado est\u00e1 intacta e pode ser recuperada apesar de o seu ponteiro ter sido removido.<\/p>\n

          Exemplo:<\/h4>\n
            \n
          • O registo eliminado no offset 0x03A9<\/code> cont\u00e9m a mensagem: \"N\u00e3o muito. Como est\u00e1s?\"<\/li>\n
          • Os campos-chave permanecem intactos, incluindo o conte\u00fado da mensagem, mesmo que outros metadados tenham sido substitu\u00eddos.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
            \n\t\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
            \n\t\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t\t\t\t\t\t

            Analisamos os freeblocks subsequentes para descobrir registos adicionais eliminados. No offset 0x03EA<\/code>, revela o cabe\u00e7alho do bloco livre:<\/p>\n

              \n
            • O tamanho do bloco livre \u00e9 0x0016<\/code> (22 bytes).<\/li>\n
            • Este \u00e9 o \u00faltimo bloco livre da cadeia, como indicado por 0x0000<\/code> no campo do ponteiro do bloco livre seguinte.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              A captura de ecr\u00e3 abaixo destaca toda a \u00e1rea da c\u00e9lula do segundo bloco livre na cadeia onde a mensagem eliminada era \"Hi Andy!\".<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t

              Identifica\u00e7\u00e3o de registos eliminados adicionais<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Mas acontece que h\u00e1 mais um registo apagado nesta p\u00e1gina n\u00e3o referenciado pela cadeia de blocos livres. Olhando para tr\u00e1s no cabe\u00e7alho da p\u00e1gina, havia apenas 2 registos nesta p\u00e1gina de acordo com o valor de dois bytes no offset 3 (0x00002<\/code>). E como s\u00f3 h\u00e1 2 registos, s\u00f3 h\u00e1 dois ponteiros na matriz de ponteiros. Esses dois ponteiros apontam para o registo #2 - \"Hey, what's up?\" e para o registo #4 - \"Hey, I was wondering if you have any Scooby snax.\" Podes reparar que h\u00e1 outra mensagem longa localizada mais acima na p\u00e1gina.<\/p>\n

              O valor de dois bytes no offset 5 no cabe\u00e7alho da p\u00e1gina \u00e9 o offset para a \u00e1rea de conte\u00fado da c\u00e9lula, essencialmente onde o pr\u00f3ximo registo ser\u00e1 escrito, isto \u00e9, a menos que caiba num dos freeblocks. Esse valor \u00e9 0x0363<\/code> que \u00e9 o deslocamento decimal 867.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              A seta na captura de ecr\u00e3 acima aponta para o deslocamento de p\u00e1gina 867. Este \u00e9 o in\u00edcio do conte\u00fado da c\u00e9lula, o que significa que o registo seguinte ser\u00e1 adicionado imediatamente acima deste registo. O registo eliminado acima deste cont\u00e9m a mensagem: \"Recebi um novo fornecimento ontem \u00e0 noite. Est\u00e1 com sorte. De quanto precisas?\"<\/p>\n

              A base de dados considera estes dados como espa\u00e7o n\u00e3o atribu\u00eddo. Tamb\u00e9m pode ser preenchido com 0x00<\/code> uma vez que n\u00e3o existe nenhum ponteiro na matriz de ponteiros que o enderece.\u00a0

              Se um registo demasiado grande para caber nos dois freeblocks da p\u00e1gina for adicionado \u00e0 tabela a que esta p\u00e1gina pertence, substituir\u00e1 a mensagem, que por acaso \u00e9 o registo #5.\u00a0<\/p>\n

              Vejamos como fica agora que identific\u00e1mos os dois freeblocks juntamente com o terceiro registo eliminado que est\u00e1 \u00e0 espera de ser substitu\u00eddo:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Depois de analisar a base de dados no seu formato bruto, podemos concluir que continha mais do que apenas os 2 registos \"vivos\" que o visualizador da base de dados apresentava.\u00a0<\/p>\n

              O registo #1 era provavelmente a mensagem \"Hi Andy!\", enquanto o registo #3 era provavelmente a mensagem \"Not much. Como est\u00e1s?\". O registo #5 ainda tem o seu n\u00famero de registo na c\u00e9lula identificada como a mensagem \"Por acaso recebi um novo fornecimento ontem \u00e0 noite. Est\u00e1s com sorte. De quanto precisas?\"<\/p>\n

              \u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t

              Conclus\u00e3o<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Os freeblocks s\u00e3o uma ferramenta poderosa nas investiga\u00e7\u00f5es forenses, oferecendo uma janela para registos eliminados e dados n\u00e3o atribu\u00eddos. Ao dominar estas t\u00e9cnicas, os investigadores podem descobrir os vest\u00edgios digitais que as bases de dados deixam para tr\u00e1s.<\/p>

              Pronto para levar as suas compet\u00eancias forenses em SQLite para o pr\u00f3ximo n\u00edvel? Explore os nossos programas de forma\u00e7\u00e3o avan\u00e7ada ou contacte-nos para saber como o podemos ajudar a tornar-se um perito forense.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

              Desvende os segredos dos freeblocks do SQLite e aprenda a recuperar registos eliminados utilizando t\u00e9cnicas forenses.<\/p>","protected":false},"author":1,"featured_media":1271,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[21],"tags":[57],"class_list":["post-992","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mobile-forensics","tag-sqlite-databases"],"acf":[],"yoast_head":"\nRecovering Deleted Data from SQLite: Navigating the Freeblock Chain<\/title>\n<meta name=\"description\" content=\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/pt\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/\" \/>\n<meta property=\"og:locale\" content=\"pt_PT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\" \/>\n<meta property=\"og:description\" content=\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/pt\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-28T20:09:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain-1024x574.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"574\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tempo estimado de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\",\"datePublished\":\"2024-11-28T20:09:37+00:00\",\"dateModified\":\"2025-07-18T18:04:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"},\"wordCount\":1036,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"keywords\":[\"SQLite Databases\"],\"articleSection\":[\"Mobile Forensics\"],\"inLanguage\":\"pt-PT\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\",\"name\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"datePublished\":\"2024-11-28T20:09:37+00:00\",\"dateModified\":\"2025-07-18T18:04:34+00:00\",\"description\":\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#breadcrumb\"},\"inLanguage\":\"pt-PT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-PT\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"width\":2912,\"height\":1632,\"caption\":\"Step-by-step guide to recovering deleted data from SQLite databases using the freeblock chain.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-PT\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-PT\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-PT\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/pt\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Recupera\u00e7\u00e3o de dados eliminados do SQLite: Navegando na cadeia de blocos livres","description":"Saiba como recuperar dados eliminados de bases de dados SQLite compreendendo e navegando na cadeia de freeblock. Este guia fornece aos investigadores forenses as t\u00e9cnicas essenciais para a recupera\u00e7\u00e3o de dados.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/pt\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","og_locale":"pt_PT","og_type":"article","og_title":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain","og_description":"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.","og_url":"https:\/\/elusivedata.io\/pt\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","og_site_name":"Elusive Data","article_published_time":"2024-11-28T20:09:37+00:00","article_modified_time":"2025-07-18T18:04:34+00:00","og_image":[{"width":1024,"height":574,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain-1024x574.png","type":"image\/png"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_misc":{"Escrito por":"James Eichbaum","Tempo estimado de leitura":"7 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain","datePublished":"2024-11-28T20:09:37+00:00","dateModified":"2025-07-18T18:04:34+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"},"wordCount":1036,"commentCount":0,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","keywords":["SQLite Databases"],"articleSection":["Mobile Forensics"],"inLanguage":"pt-PT","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","url":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","name":"Recupera\u00e7\u00e3o de dados eliminados do SQLite: Navegando na cadeia de blocos livres","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","datePublished":"2024-11-28T20:09:37+00:00","dateModified":"2025-07-18T18:04:34+00:00","description":"Saiba como recuperar dados eliminados de bases de dados SQLite compreendendo e navegando na cadeia de freeblock. Este guia fornece aos investigadores forenses as t\u00e9cnicas essenciais para a recupera\u00e7\u00e3o de dados.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#breadcrumb"},"inLanguage":"pt-PT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"]}]},{"@type":"ImageObject","inLanguage":"pt-PT","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","width":2912,"height":1632,"caption":"Step-by-step guide to recovering deleted data from SQLite databases using the freeblock chain."},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain"}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"ElusiveData","description":"Excel\u00eancia em forma\u00e7\u00e3o e consultoria forense digital","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-PT"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"ElusiveData","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"pt-PT","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"pt-PT","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/pt\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/posts\/992","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/comments?post=992"}],"version-history":[{"count":59,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/posts\/992\/revisions"}],"predecessor-version":[{"id":1437,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/posts\/992\/revisions\/1437"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/media\/1271"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/media?parent=992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/categories?post=992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/tags?post=992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}