Quote::
But I still I would like to know is header rewrite in some occasions? Any idea about possible reasons for change.
The header should only be written when SQLite is running. So my guess is that one or more aplications (that write to these specific databases) are running in the background.
Simply browsing through a few web sites can cause changes in (for example) the cookies and places sqlite files.
Simply restarting the phone could cause the diffierent applications to run and there are many reasons that a database might be updated on application start - not least of which is sqlite finding a WAL file that hadn't been checkpointed - which would then be written to the main sqlite table
However you refer to offset 96 of the main sqlite database header - this 4 byte big endian integer refers to the last version of SQLite to write to this database. In normal use this should only be changed if the SQLite library has been updated. And the db size at offset 28 should only change of the database size has changed. Both of which indicate that something more has happened, i.e. the SQLite library has been updated AND something has been added to or deleted from the database.
This is of course supported by your previous comment that new tables have been inserted and that you are rebooting the device. And it sounds like one or more applications have contacted their home server and updated in the background.
↧