{"id":992,"date":"2024-11-28T20:09:37","date_gmt":"2024-11-28T20:09:37","guid":{"rendered":"https:\/\/elusivedata.io\/?p=992"},"modified":"2025-07-18T18:04:34","modified_gmt":"2025-07-18T18:04:34","slug":"aterskapa-raderade-data-fran-sqlite-navigera-i-freeblock-kedjan","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/sv\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","title":{"rendered":"\u00c5terst\u00e4lla raderade data fr\u00e5n SQLite: Navigera i Freeblock-kedjan"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Inledning<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

SQLite-databaser \u00e4r skattkistor med digitala bevis som finns i m\u00e5nga appar, fr\u00e5n chattmeddelanden till transaktionsloggar. Men vad h\u00e4nder n\u00e4r poster raderas? Skriv in freeblocks<\/em>-Dolda sektioner av oanv\u00e4nt utrymme inom databassidor som inneh\u00e5ller rester av raderade data. Dessa freeblocks \u00e4r en guldgruva f\u00f6r kriminaltekniska utredare, eftersom de g\u00f6r det m\u00f6jligt att \u00e5terskapa viktiga poster och avsl\u00f6ja dolda bevis.<\/p>

Den h\u00e4r bloggen avmystifierar SQLite freeblocks och g\u00e5r igenom hur de fungerar, hur man hittar dem med verktyg som hexredigerare och hur man \u00e5terst\u00e4ller raderade poster. Oavsett om du \u00e4r en utredare eller en digital kriminalteknisk entusiast kommer den h\u00e4r guiden att utrusta dig med viktiga tekniker f\u00f6r att extrahera dolda data.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Vad \u00e4r Freeblocks i SQLite?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Freeblocks \u00e4r delar av oanv\u00e4nt utrymme inom en SQLite-databassida. N\u00e4r en post raderas skrivs inte motsvarande utrymme \u00f6ver omedelbart om inte en s\u00e4ker raderingsmekanism \u00e4r aktiverad. Ist\u00e4llet markeras det som en freeblock<\/strong>, tillg\u00e4nglig f\u00f6r framtida skrivningar.<\/p>\n

I den h\u00e4r processen:<\/p>\n

    \n
  • Pekaren till den borttagna posten tas bort.<\/li>\n
  • Sidhuvudet uppdateras f\u00f6r att \u00e5terspegla borttagningen.<\/li>\n
  • Om till\u00e4mpligt justeras den offset som pekar mot det f\u00f6rsta freeblocket.<\/li>\n<\/ul>\n

    \u00a0<\/p>\n

    Dessa freeblocks har ofta kvar rester av originaldata, vilket g\u00f6r dem till ett kritiskt fokus f\u00f6r kriminaltekniska utredare som vill \u00e5terst\u00e4lla raderade poster.<\/p>\n

    Exempel:<\/h4>\n

    I sk\u00e4rmdumpen nedan unders\u00f6ker vi en SQLite-databas med hj\u00e4lp av DB Browser. Tabellen \"meddelanden\" visar tv\u00e5 live-poster, men kriminaltekniska ledtr\u00e5dar tyder p\u00e5 att det finns ytterligare raderade poster.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Hur freeblocks passar in i sidhuvudet p\u00e5 SQLite-sidor<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    F\u00f6r att hitta och analysera freeblocks m\u00e5ste vi f\u00f6rst f\u00f6rst\u00e5 strukturen p\u00e5 SQLite-databassidorna. Varje sida inneh\u00e5ller en rubrik som inneh\u00e5ller viktiga metadata, inklusive pekare till freeblocks.<\/p>\n

    I tabellen nedan beskrivs rubrikstrukturen f\u00f6r en sidtyp av typen 0D:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n
    Offset<\/th>\r\n Storlek<\/th>\r\n Beskrivning<\/th>\r\n <\/tr>\r\n <\/thead>\r\n
    0<\/td>\r\n 1 byte<\/td>\r\n Sidtyp<\/td>\r\n <\/tr>\r\n
    1<\/td>\r\n 2 byte<\/td>\r\n Byte-offset till den f\u00f6rsta freeblocken<\/strong><\/td>\r\n <\/tr>\r\n
    3<\/td>\r\n 2 byte<\/td>\r\n Antal celler p\u00e5 sidan<\/td>\r\n <\/tr>\r\n
    5<\/td>\r\n 2 byte<\/td>\r\n Offset till den f\u00f6rsta byten i cellens inneh\u00e5ll<\/td>\r\n <\/tr>\r\n
    7<\/td>\r\n 1 byte<\/td>\r\n Antal fragmenterade fria bytes i celler<\/td>\r\n <\/tr>\r\n <\/tbody>\r\n<\/table>\r\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Viktig information att ta med sig:<\/h4>\n

    V\u00e4rdet vid offset 1 i sidhuvudet pekar p\u00e5 det f\u00f6rsta freeblocket. Om detta v\u00e4rde \u00e4r 0x0000<\/code>finns det inga freeblocks p\u00e5 sidan.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Anv\u00e4nda hexeditorer f\u00f6r att analysera freeblocks<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    F\u00f6r att lokalisera det f\u00f6rsta freeblocket \u00f6ppnar vi databasen i en hexredigerare. V\u00e4rdet p\u00e5 tv\u00e5 byte vid offset 1 i sidhuvudet ger offseten till freeblockets plats.<\/p>\n

    I exemplet nedan:<\/p>\n

      \n
    • Hexredigeraren markerar offset 0x03A9<\/code> (decimal 937) i r\u00f6tt, vilket pekar p\u00e5 platsen f\u00f6r det f\u00f6rsta freeblocket.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Genom att navigera till denna offset avsl\u00f6jas b\u00f6rjan p\u00e5 freeblocket. Nedan unders\u00f6ker vi cellen som ligger vid offset 937.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Avkodning av freeblock-headers<\/h3>\n

      Varje freeblock inneh\u00e5ller en header p\u00e5 fyra byte som best\u00e5r av:<\/p>\n

        \n
      1. F\u00f6rsta 2 byte<\/strong>: Offset till n\u00e4sta freeblock (0x0000<\/code> om det inte finns n\u00e5gon).<\/li>\n
      2. Andra 2 byte<\/strong>: Total storlek p\u00e5 freeblocket, inklusive sj\u00e4lva rubriken.<\/li>\n<\/ol>\n

        Exempel:<\/h4>\n

        Vid offset 0x03A9<\/code>, indikerar freeblock-headern:<\/p>\n

          \n
        • N\u00e4sta freeblock \u00e4r vid offset 0x03EA<\/code> (decimal 1002).<\/li>\n
        • Storleken p\u00e5 freeblock \u00e4r 0x0024<\/code> (36 byte, inklusive sidhuvudet).<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
          \n\t\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t

          \u00c5terst\u00e4lla raderade poster med hj\u00e4lp av Freeblocks<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
          \n\t\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t

          Freeblocks inneh\u00e5ller ofta rester av raderade poster, vilket g\u00f6r det m\u00f6jligt f\u00f6r kriminaltekniska utredare att \u00e5terst\u00e4lla partiella eller fullst\u00e4ndiga data. I sk\u00e4rmdumpen nedan \u00e4r nyttolasten f\u00f6r en raderad post intakt och kan \u00e5terst\u00e4llas trots att dess pekare har tagits bort.<\/p>\n

          Exempel:<\/h4>\n
            \n
          • Den raderade posten vid offset 0x03A9<\/code> inneh\u00e5ller meddelandet: \"Inte mycket. Hur \u00e4r det med dig?\"<\/li>\n
          • Viktiga f\u00e4lt f\u00f6rblir intakta, inklusive meddelandets inneh\u00e5ll, \u00e4ven om andra metadata har skrivits \u00f6ver.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
            \n\t\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
            \n\t\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t\t\t\t\t\t

            Vi analyserar efterf\u00f6ljande freeblock f\u00f6r att uppt\u00e4cka ytterligare raderade poster. Vid offset 0x03EA<\/code>, avsl\u00f6jar freeblock-headern:<\/p>\n

              \n
            • Freeblockets storlek \u00e4r 0x0016<\/code> (22 byte).<\/li>\n
            • Detta \u00e4r det sista freeblocket i kedjan, vilket indikeras av 0x0000<\/code> i n\u00e4sta freeblock pointerf\u00e4lt.<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Nedanst\u00e5ende sk\u00e4rmdump visar hela cellomr\u00e5det f\u00f6r det andra freeblocket i kedjan d\u00e4r det raderade meddelandet var \"Hej Andy!\"<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t

              Identifiering av ytterligare raderade poster<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Men det r\u00e5kar finnas ytterligare en raderad post p\u00e5 den h\u00e4r sidan som inte refereras till av freeblockkedjan. Om man tittar tillbaka p\u00e5 sidhuvudet fanns det bara 2 poster p\u00e5 den h\u00e4r sidan enligt tv\u00e5bytesv\u00e4rdet vid offset 3 (0x00002<\/code>). Och eftersom det bara finns tv\u00e5 poster finns det bara tv\u00e5 pekare i pekararrayen. Dessa tv\u00e5 pekare pekar p\u00e5 post #2 - \"Hej, l\u00e4get?\" och post #4 - \"Hej, jag undrar om du har n\u00e5gon Scooby snax.\" Du kanske m\u00e4rker att det finns ett annat l\u00e5ngt meddelande l\u00e4ngre upp p\u00e5 sidan.<\/p>\n

              V\u00e4rdet p\u00e5 tv\u00e5 byte vid offset 5 i sidhuvudet \u00e4r offset till cellens inneh\u00e5llsomr\u00e5de, i princip d\u00e4r n\u00e4sta post skulle skrivas, det vill s\u00e4ga om den inte kan rymmas i ett av freeblocken. Detta v\u00e4rde \u00e4r 0x0363<\/code> vilket \u00e4r decimal offset 867.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Pilen i sk\u00e4rmdumpen ovan pekar p\u00e5 sidoffset 867. Detta \u00e4r b\u00f6rjan p\u00e5 cellinneh\u00e5llet, vilket inneb\u00e4r att n\u00e4sta post kommer att l\u00e4ggas till precis ovanf\u00f6r den h\u00e4r posten. Den raderade posten ovanf\u00f6r denna inneh\u00e5ller meddelandet \"Jag r\u00e5kade f\u00e5 in en ny leverans i g\u00e5r kv\u00e4ll. Du har tur. Hur mycket beh\u00f6ver du?\"<\/p>\n

              Databasen betraktar dessa data som oallokerat utrymme. Det kan lika g\u00e4rna fyllas med 0x00<\/code> eftersom det inte finns n\u00e5gon pekare i pekararrayen som adresserar den.\u00a0

              Om en post som \u00e4r f\u00f6r stor f\u00f6r att rymmas inom de tv\u00e5 freeblocken p\u00e5 sidan l\u00e4ggs till i den tabell som den h\u00e4r sidan tillh\u00f6r, kommer den att skriva \u00f6ver meddelandet, som r\u00e5kar vara post #5.\u00a0<\/p>\n

              L\u00e5t oss se hur det ser ut nu n\u00e4r vi har identifierat de tv\u00e5 freeblocken tillsammans med den tredje raderade posten som v\u00e4ntar p\u00e5 att skrivas \u00f6ver:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SQLite\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Efter att ha analyserat databasen i dess r\u00e5a format kan vi dra slutsatsen att den inneh\u00f6ll mer \u00e4n bara de 2 \"live\"-poster som databasvisaren visade.\u00a0<\/p>\n

              Inspelning #1 var sannolikt meddelandet \"Hej Andy!\" medan inspelning #3 sannolikt var meddelandet \"Inte mycket. Hur \u00e4r det med dig?\". Post #5 har fortfarande sitt postnummer i sin cell identifierat som meddelandet, \"Jag r\u00e5kade f\u00e5 in en ny leverans i g\u00e5r kv\u00e4ll. Du har tur. Hur mycket beh\u00f6ver du?\"<\/p>\n

              \u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t

              Slutsats<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              Freeblocks \u00e4r ett kraftfullt verktyg i kriminaltekniska utredningar, eftersom de ger en inblick i raderade poster och oallokerade data. Genom att beh\u00e4rska dessa tekniker kan utredare avsl\u00f6ja de digitala sp\u00e5r som databaser l\u00e4mnar efter sig.<\/p>

              \u00c4r du redo att ta dina SQLite-forensiktiga f\u00e4rdigheter till n\u00e4sta niv\u00e5? Utforska v\u00e5ra avancerade utbildningsprogram eller kontakta oss f\u00f6r att f\u00e5 veta hur vi kan hj\u00e4lpa dig att bli en kriminalteknisk expert.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

              Avsl\u00f6ja hemligheterna med SQLite freeblocks och l\u00e4r dig hur du \u00e5terst\u00e4ller raderade poster med hj\u00e4lp av kriminaltekniska tekniker.<\/p>","protected":false},"author":1,"featured_media":1271,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[21],"tags":[57],"class_list":["post-992","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mobile-forensics","tag-sqlite-databases"],"acf":[],"yoast_head":"\nRecovering Deleted Data from SQLite: Navigating the Freeblock Chain<\/title>\n<meta name=\"description\" content=\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/sv\/aterskapa-raderade-data-fran-sqlite-navigera-i-freeblock-kedjan\/\" \/>\n<meta property=\"og:locale\" content=\"sv_SE\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\" \/>\n<meta property=\"og:description\" content=\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/sv\/aterskapa-raderade-data-fran-sqlite-navigera-i-freeblock-kedjan\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-28T20:09:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain-1024x574.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"574\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Skriven av\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Ber\u00e4knad l\u00e4stid\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minuter\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\",\"datePublished\":\"2024-11-28T20:09:37+00:00\",\"dateModified\":\"2025-07-18T18:04:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"},\"wordCount\":1036,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"keywords\":[\"SQLite Databases\"],\"articleSection\":[\"Mobile Forensics\"],\"inLanguage\":\"sv-SE\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\",\"name\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"datePublished\":\"2024-11-28T20:09:37+00:00\",\"dateModified\":\"2025-07-18T18:04:34+00:00\",\"description\":\"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#breadcrumb\"},\"inLanguage\":\"sv-SE\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"sv-SE\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/freeblock_chain.png\",\"width\":2912,\"height\":1632,\"caption\":\"Step-by-step guide to recovering deleted data from SQLite databases using the freeblock chain.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"sv-SE\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"sv-SE\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"sv-SE\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/sv\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u00c5terst\u00e4lla raderade data fr\u00e5n SQLite: Navigera i Freeblock-kedjan","description":"L\u00e4r dig hur du \u00e5terst\u00e4ller raderade data fr\u00e5n SQLite-databaser genom att f\u00f6rst\u00e5 och navigera i freeblock-kedjan. Den h\u00e4r guiden ger kriminaltekniska utredare viktiga tekniker f\u00f6r data\u00e5terst\u00e4llning.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/sv\/aterskapa-raderade-data-fran-sqlite-navigera-i-freeblock-kedjan\/","og_locale":"sv_SE","og_type":"article","og_title":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain","og_description":"Learn how to recover deleted data from SQLite databases by understanding and navigating the freeblock chain. This guide provides forensic investigators with essential techniques for data recovery.","og_url":"https:\/\/elusivedata.io\/sv\/aterskapa-raderade-data-fran-sqlite-navigera-i-freeblock-kedjan\/","og_site_name":"Elusive Data","article_published_time":"2024-11-28T20:09:37+00:00","article_modified_time":"2025-07-18T18:04:34+00:00","og_image":[{"width":1024,"height":574,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain-1024x574.png","type":"image\/png"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_misc":{"Skriven av":"James Eichbaum","Ber\u00e4knad l\u00e4stid":"7 minuter"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain","datePublished":"2024-11-28T20:09:37+00:00","dateModified":"2025-07-18T18:04:34+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"},"wordCount":1036,"commentCount":0,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","keywords":["SQLite Databases"],"articleSection":["Mobile Forensics"],"inLanguage":"sv-SE","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","url":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/","name":"\u00c5terst\u00e4lla raderade data fr\u00e5n SQLite: Navigera i Freeblock-kedjan","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","datePublished":"2024-11-28T20:09:37+00:00","dateModified":"2025-07-18T18:04:34+00:00","description":"L\u00e4r dig hur du \u00e5terst\u00e4ller raderade data fr\u00e5n SQLite-databaser genom att f\u00f6rst\u00e5 och navigera i freeblock-kedjan. Den h\u00e4r guiden ger kriminaltekniska utredare viktiga tekniker f\u00f6r data\u00e5terst\u00e4llning.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#breadcrumb"},"inLanguage":"sv-SE","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/"]}]},{"@type":"ImageObject","inLanguage":"sv-SE","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/freeblock_chain.png","width":2912,"height":1632,"caption":"Step-by-step guide to recovering deleted data from SQLite databases using the freeblock chain."},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/recovering-deleted-data-from-sqlite-navigating-the-freeblock-chain\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"Recovering Deleted Data from SQLite: Navigating the Freeblock Chain"}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"ElusiveData","description":"Utbildning och r\u00e5dgivning inom digital kriminalteknik","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"sv-SE"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"ElusiveData","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"sv-SE","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"sv-SE","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/sv\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/posts\/992","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/comments?post=992"}],"version-history":[{"count":59,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/posts\/992\/revisions"}],"predecessor-version":[{"id":1437,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/posts\/992\/revisions\/1437"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/media\/1271"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/media?parent=992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/categories?post=992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/tags?post=992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}