-
(sqlite) with WAL, without WALSolar Beam 2023. 8. 17. 23:07
> There are three files. Here comes the question.
If you open that db file with DB browser or sqlite3.exe,
will the result be the content of db file only or the content of db file with WAL?
> The hash value of knowledgeC.db without WAL is provided below.
> First, remove those 'shm' and 'wal' files in the directory, open the db file using DB Browser or sqlite3.exe and check the number of records in the ZOBJECT table. The number of records without WAL is 8460.
> Second, place those 'shm' and 'wal' files in the directory, open the db file using DB Browser or sqlite3.exe and check the number of records in the ZOBJECT table. The number of records with WAL is 8464.
> Quit sqlite3 connection normally with the command ".quit". Checkpoint will occur and the hash value of the db file with WAL is provided below. It changed. If you use DB browser, the result will be the same.
> If you exit sqlite3 connection abnormally, such as by closing the command prompt directly, checkpoint will not occur. The hash value remains unchanged from the value of the DB file without WAL.
> When does the checkpoint occur?
> Also, it needs a clean shutdown.
> If you use ArtEx2 and its wal comparison function, you can see the difference in the number of records in ZOBJECT table too. It is consistent with our findings from earlier.
> So, I quess the answer to the question is the content of the db file with WAL.
> And if you cleanly shut down the DB connection, checkpoint occurs. If not, WAL remains.
'Solar Beam' 카테고리의 다른 글
(2022) 중고거래 어플리케이션에서의 아티팩트 수집 및 분석 (0) 2023.08.26 (iOS) 탈옥(jailbreak)의 개념 및 종류 (0) 2023.08.09 (2013) 스마트폰 내부 정보 추출 방법 (0) 2023.08.08 (2017) 안드로이드 기반 스마트폰 비휘발성 시스템 로그에 대한 분석 (0) 2023.08.07 (2017) iOS 로그 분석 및 포렌식 활용방안 연구 (0) 2023.08.03