Zul22 wrote:
Hello,
Thanks.
1) If I use FLOAT instead of REAL, the program displays the "Done! Have a nice day." message, as well as the column names, but no record is displayed.
Only using INTEGER instead of REAL allowed to display the messages.
Yes, this is for a WhatsApp database and fields using REAL are "Latitude" and "Longitude".
If it's for a WhatsApp database it's going to be quite problematic because if I remember well WhatsApp has a very annoying behavior of saving empty values with integers (e.g. 0) rather than with NULL (and very likely other bad surprises in the record data). That would mean you'd have to try a lot of different schema combinations to possibly obtain all the data. Maybe it would be better to write a little script that looks for phone numbers in the database file and outputs the record data if it figures out that it belongs to a message in order to avoid losing important data, that would also help with recovering single deleted records whose header has been partially overwritten therefore being currently undetectable by my software.
Zul22 wrote:
2) As the GUI does not allow proper copy/paste, would it be possible to call the parser library as a DLL? Currently the software is a monolithic ".exe", but it could be a ".exe" calling a ".dll".
Alternatively, would it be possible to call the .exe from a shell, passing to it argc,argv arguments and pipe the output somewhere, as a CSV file or SQL queries including the deleted records?
I can have the tool output the scanned data to a text file if that may help.
Zul22 wrote:
3) Sure that AUTOINCREMENT values are not stored in the database.
But why not detect the statement "AUTOINCREMENT" in the query, use a counter in the loop that your carver does, generate the values "1, 2, 3, ..." and maybe give them a different color so that we know they were not stored in the database?
The key is not generated/made up by the SQLite library while reading, it's usually borrowed from the real record number that every SQLite record has and that is present on every record included those without keys. When the record has a primary key integer that value is stored as NULL to save space. I can have the record number column printed in every case if that can help.
Zul22 wrote:
4) I cannot currently remember which database made the program crash.
I'll write it down next time.
There was no error message, but the software was not responding.
Could be some issue with the UI, I don't think there's anything in the carving library that could make it hang while reading. Let me know if you run into the same issue again.
↧