SQLite keeps new records in so-called Write Ahead Logs (WAL files). However, there is another feature of SQLite databases that may give us a chance. Data from WAL filesĪs we learned earlier, all even remotely recent versions of iOS effectively prevent the recovery of deleted records (be it messages, call logs or contacts) by quickly vacuuming SQLite databases. Let’s forget about this trick, and move to the next one. To sum it up, the SQLite trick is no longer effective for deleted iMessages, Safari bookmarks, tabs and history, or any other types of data stored in SQLite databases. Since this is hardly practical, you are very unlikely to ever recover SQLite records deleted in iOS 12 and newer. Since iOS 12, the system wipes deleted records almost immediately after they are deleted. You must be quick enough, extracting the affecting database in a matter of seconds after the record was deleted.

The database itself had not been vacuumed or defragmented, in which case the deletion becomes permanent (read: you must act soon).

You were able to extract the affected SQLite database with a low-level extraction tool (read: you need a jailbreak or Elcomsoft iOS Forensic Toolkit).

Such deleted records could be stored in SQLite “freelists” for some time, which left room for data recovery tools to attempt the recovery. Instead, the SQLite engine marks the record as “deleted”, marks the page as unused, adds a reference to the so-called “freelist”.

Once the user deletes a record (such as an iMessage from the Messages app, or a Safari bookmark, or a history item), that record is not wiped clean in the SQLite database immediately due to performance considerations. Deleted records from SQLite databasesĪpple stores many types of user data in various databases in SQLite format. Below are the types of data you can actually recover. In this article we’ll talk about what you can and what you cannot recover in modern iOS devices.īefore we begin, I highly recommend reading our previous article aimed at demystifying bogus claims made by some unscrupulous vendors of data recovery tools: The iPhone Data Recovery Myth: What You Can and Cannot Recover. There are also tricks allowing to recover some bits and pieces even if you don’t. IOS security model offers very are few possibilities to recover anything unless you have a backup, either local or one from the cloud.

Iphone forensics toolkit passcode