Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20107

General Discussion: Unexpected SQLite field data in WhatsApp databases

$
0
0
I was already familiar with that field type (Constant 0) however from how I interpreted the specifications a BLOB (or a TEXT) field cannot have that value because neither have affinity with INTEGER/NUMERIC. I created a test database with SQLite Browser and wrote an empty BLOB field and a BLOB field with a '\0' value. The first BLOB was serialized with a '12' serial type (0 bytes-long BLOB) while the second BLOB was serialized with a '14' serial type (1 byte-long BLOB) along with the associated 1-byte data containing the '\0' character so what WhatsApp does doesn't seem like a standard/documented behavior.

Viewing all articles
Browse latest Browse all 20107

Trending Articles