A special case (accessing deleted data on mobile platforms) applies to information stored inside SQLite databases. SQLite is a universally accepted database format employed by countless system and third-party apps running on all popular mobile platforms. Android and iOS keep call logs, message history, Web browsing logs, and many system settings in SQLite databases. Applications such as Chrome, Firefox, Skype, WhatsApp, and countless others also use SQLite.
Unlike files deleted from encrypted partitions, records deleted from SQLite databases may not immediately disappear. In a naive attempt to counter forensic efforts, users may clear call history, delete message logs, and clear the browsing history. These measures may not be as effective as users think.
The reason for these measures being unreliable is the way in which SQLite deletes records. Due to performance considerations, SQLite does not wipe deleted records (which...