When it comes to adding more data, if there’s space your phone will add extra files.

It just says “huh, forget about this”, and moves on. So the old data isn’t removed, it’s just left unlabelled (or “orphaned”, we as might technically call it.) This means that when you delete data, your phone doesn’t need to go through a relatively slow process of freeing up space in the cabinet.

But when you remove data, rather than taking the file out of the filing cabinet, the phone simply pulls the label off.

When it’s time to add information to them, you’d add a file with a neat label on it, explaining what’s in the file, and that’s how your phone works.

Think of these databases like big filing cabinets: Without getting too technical, it’s pretty simple how the process works. And, if the need arises, you’ll have better than average odds at recovering your deleted iOS data because of the infrequent nature of this maintenance process. For users, that’s the right balance: your iPhone will be reasonably quick, and your data will be robust. It is possible for these cleanup or optimisation operations to occur with SQLite, but they tend to be run infrequently. Users don’t want to have an app slow down whilst the database performs routine maintenance such as cleaning up indexes, for example.

In particular, in order for access to be fast it can’t regularly maintain itself when it is being used. As SQLite runs without a separate database server there are a few ways in which it differs from other databases.

SQLite is a neat little server-less database format and fits well for what Apple and app vendors need. Simply put, many apps store their data in databases, and most of them use the SQLite format. Today, we’re going to take a dive into one of the approaches we use for recovering deleted messages: forensic recovery of SQLite data. There are many techniques we use when it comes to helping people recover their data with our products, and a lot of the cleverness we’ve built over the last decade lies below the surface.

Apple backup reader