Recovering Data from Deleted SQLite Records: Redux

[sbinet]

interesting post about recovering data:
http://linuxsleuthing.blogspot.ch/2013/09/recovering-data-from-deleted-sqlite.html

from struct import unpack

with open('some.db', 'rb') as f:
 data = f.read()

pageSize = unpack('>h', data[16:18])[0]

pageList = []

for offset in range(0, len(data), pageSize):
 if data[offset] == 13;
 pageList.append(offset)

for offset in pageList:
 page = data[offset: offset + pageSize]

 pageHeader = unpack('>bhhhb', page[:8])
 pageByte, fbOffset, cellQty, cellOffset, freebytes = pageHeader

 # get unallocated
 start = 8 + cellQty * 2
 end = cellOffset-start
 unalloc = page[start:end]
 print(offset, unalloc, sep=',')

 # get freeblocks, if any
 if fbOffset > 0:
 while fbOffset != 0:
 start, size = unpack('>hh', page[fbOffset: fbOffset + 4])
 freeblock = page[fbOffset: fbOffset + size]
 print(offset, freeblock, sep = ',')
 fbOffset = start