SQLite Database
| Format | SQLite Database |
|---|---|
| Short name | SQLite |
| Category | database |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (SQLiteParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
The dominant embedded database on iOS, Android, macOS, and Windows. Used by virtually every app for messages, call logs, contacts, browser history, location data, and app state. Identified by a 16-byte magic string ('SQLite format 3\000') at offset 0. 100-byte file header contains: page size, write version (rollback=1, WAL=2), encoding, and change counter. Key forensic recovery mechanisms: (1) Freelist — deleted pages retained in a free-page list; records survive until overwritten by new insertions. (2) Freeblocks and page slack space — deleted records within active pages may survive in freeblocks or partially in the unallocated area below the live cell pointer array. (3) WAL (Write-Ahead Log) — in WAL mode, the -wal file contains uncommitted and recently checkpointed pages; must be analysed alongside the main DB. WAL slack: after checkpoint, old pages remain in the WAL until overwritten from the start — prior database states are recoverable. CRITICAL: opening a WAL-mode database with a standard SQLite driver triggers a checkpoint, irreversibly committing and clearing the WAL — use read-only forensic tools or low-level parsing only. sqlite_sequence table gaps reveal deleted AUTOINCREMENT rows.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00 | SQLite format 3. | SQLite magic string ('SQLite format 3\x00') |
Known extensions
.db, .sqlite, .sqlite3, .db3
References
- SQLite file format specification https://www.sqlite.org/fileformat.html
- Mobile Forensics – The File Format Handbook: SQLite (Springer, 2022) https://doi.org/10.1007/978-3-030-98467-0_5
- Forensic analysis of SQLite databases: free lists, WAL, unallocated space and carving (Belkasoft) https://belkasoft.com/sqlite-analysis
- Forensic examination of SQLite Write Ahead Log files (Sanderson Forensics) https://sqliteforensictoolkit.com/forensic-examination-of-sqlite-write-ahead-log-wal-files/
- FQLite — deleted SQLite record recovery (Pawlaszczyk; see 'Making the Invisible Visible', 2021) https://github.com/pawlaszczyk/fqlite
- A comprehensive analysis and evaluation of SQLite deleted record recovery techniques: a survey (Lee et al., FSI: Digital Investigation 2025) https://www.sciencedirect.com/science/article/abs/pii/S2666281725001714
- What Hides in the WAL — SQLite Forensics with crush (beBinary) https://bebinary4n6.blogspot.com/2026/05/what-hides-in-wal-sqlite-forensics-with.html
Cite this entry
Crush Format Reference, “SQLite Database”. https://kalink0.github.io/crush-forensics/formats/sqlite/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction