SQLite 데이터베이스의 삭제된 오버플로우 데이터 복구 기법

다국어 초록 (Multilingual Abstract)

As many applications in smartphone use SQLite database to store data, the recovery of deleted data from the file is very important issue in the field of digital forensics. SQLite database stores data as a unit of the record, and the record is generally stored on the cell of B-tree leaf page. Therefore, the previous researches proposed the record recovery scheme on B-tree leaf page. However they wouldnt recover data of overflow pages that store exceeding available cells in B-tree leaf page. Therefore, they recover data only on the B-tree leaf page. To resolve the problem, we propose a scheme that entirely recovers the deleted data on both the B-tree leaf page and the overflow pages. Experimental results show the proposed scheme entirely recovers the deleted data in the database file of kakaotalk application.

참고문헌 (Reference)

1 김도윤, "위치기반 서비스를 이용하는 효율적인 단체관광안내시스템의 구현" 한국정보기술학회 9 (9): 185-192, 2011

2 R. Drinkwater, "http://forensicsfromthesausagefactory. blogspot.kr/2011/05/sqlite-pointer-maps-pages.html"

3 R. Drinkwater, "http://forensicsfromthesausagefactory. blogspot.kr/2011/04/carving-sqlite-databases-from.html"

4 SQLite, "The SQLite Database File Format"

5 SQLite, "The SQLite Database File Format"

6 이성일, "SQLite 데이터베이스의 스키마 패턴 분석을 이용한 삭제 레코드 추출 기법 연구" 65-75, 2011

7 전상준, "SQLite 데이터베이스의 비 할당 영역에 잔존하는 삭제된 레코드 복구 기법" 한국정보보호학회 21 (21): 143-154, 2011

8 "Oxygen Forensic Suite 2012"

9 오지혜, "GPS 수신기를 활용한 다양한 크기의 지도를 사용하는 위치기반서비스의 구현" 한국정보기술학회 8 (8): 19-24, 2010

10 M. T. Pereira, "Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records" 5 (5): 93-103, 2004

11 R. Rii, "Chrome SQlite db finder v1.4"

12 S. Gunasekera, "An Intimate Hour with iPhone SQLite Databases" 2011

13 S. Jeon, "A recovery method of deleted record for SQLite database" 16 (16): 707-715, 2004

14 "010editor"