Bring the shine back into your database with SQBrite!
SQBrite is a data recovery/forensics tool for SQLite databases. It uses a Python 3 implementation of the SQLite on-disk file format to recover deleted table rows.
SQBrite’s name is inspired by PL Daniels’ undark, but is a completely separate implementation.
Installing SQBrite
SQBrite requires Python 3. To install, simply run:
$ pip3 install --user sqbrite
$ sqbrite --helpBackground
SQLite uses a paginated data model in which each database is a collection of same-size pages. There are several kinds of pages, of which one type (B-Tree Table Leaf pages) contains the starting point for actual data belonging to individual table rows.
When a row is deleted by means of a DELETE FROM table (...) statement, the space occupied by that row’s data (a record) within the relevant B-Tree Table Leaf page is marked as free and may subsequently be used to store new records or update existing records. However, it is common to see freed space within a page (a freeblock, in SQLite parlance) left alone after rows are deleted. In that case, it *may* be possible to retrieve deleted row data from within the freeblock.
Heuristics
The SQLite file format doesn’t keep track of where deleted records start and end within a leaf page’s freeblocks. This means that SQBrite needs a mechanism to find out where record headers start. This is achieved through the use of byte-wise regular expressions specific to tables in known databases. These regular expressions and the offset that separates matches from the first byte in a well-formed header are stored in a user-editable YAML file.
SQBrite aims to ship with heuristics for popular SQLite databases, so do send pull requests if you’ve got good results with your heuristics.
Features
Export all records to CSV or reinject “undeleted” records into a copy of the database
Extensible heuristics - just add entries to ~/.local/share/sqbrite/sqbrite.yaml!
SQBrite can recover records from within active B-tree table leaf pages or from former table-leaf Freelist pages.
Heuristics for iOS and Firefox databases
Limitations
SQBrite works better when ptrmap pages are present
The undelete subcommand may fail when re-inserting deleted rows into a table causes a constraint violation
SQBrite cannot recover records deleted with the SQLite secure_delete pragma enabled
Recovering data from overflow pages that have become Freelist leaf pages is not currently supported
Acknowledgments
Big thanks to @tobraha for contributing bugfixes in 2022.
1 maintainer
Metadata
1 maintainer
Release files for sqbrite 0.17
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| sqbrite-0.17-py3-none-any.whl | Python 3 | none | any | Details for sqbrite-0.17-py3-none-any.whl |
Release files / sqbrite-0.17-py3-none-any.whl
| Download URL | sqbrite-0.17-py3-none-any.whl |
|---|---|
| Size | 30.8 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
73b4b5a84375042be840b9b9d9e3f3429a3aa6f0515ae2448429d3de3aaaea44
|
|
BLAKE2b-256 checksum How to use checksums |
321cef683a7f0a2835499d28a54ee5772403b1fe7746f9369a72dba2f36908a1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.8.0 pkginfo/1.8.2 readme-renderer/34.0 requests/2.26.0 requests-toolbelt/0.9.1 urllib3/1.26.7 tqdm/4.63.0 importlib-metadata/4.8.1 keyring/21.8.0 rfc3986/2.0.0 colorama/0.4.3 CPython/3.10.2
|
Security for sqbrite 0.17
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
