After recovering deleted base, it is encrypted


#1

Hi Guys,

I have a great problem. My SQLite database was deleted but I recovered it using some “Recover Tool”. After that, when I try to open connection I get a error message Database is encrypted or is not a database. When trying to open it with DB, it asks me : “Please enter the key used to encrypt the database. If any of the other settings were altered for this database file you need to provide this information as well.”

The main problem is that I didn’t encrypted it but now it is encrypted. Is there any default key to decrypt it ? What can I do to save data from database. It is very important not to lose it !

Thanks in advance !


#2

Hi @Goran_Klasic

Thanks for posting, although Zetetic didn’t create DB Browser for SQLite.

That being said, my initial guess would be that something went awry with the “Recovery Tool” causing the database to become corrupted which would mean the first page of the database no longer has the standard SQLite markers. My assumption is this would cause DB Browser for SQLite to assume it’s a SQLCipher encrypted database (or not a database).

It may be helpful to try to open the database with a standard sqlite command line tool and run PRAGMA integrity_check;.

Maybe @justinclift would have some additional insight?

Cheers,
Micah


#3

Hi @mmore,

Thanks for help. I tried running PRAGMA integrity_check and result is : Error : file is encrypted or is not a database. Tried with another recover tool but without luck. It seems like I need to find a way to repair database. If you have any proposals I would be very grateful.


#4

Yep, that dialog - asking for the encryption information - is what DB Browser for SQLite pops up when it can’t load the database. The assumption is that the file is encrypted (not damaged), which needs some extra info for it to open ok.

Since it sounds like the file wasn’t actually encrypted… that’s not good. It almost definitely means the file is damaged in some way. :frowning:

If you try opening it with the standard command line “sqlite3” program (from sqlite.org), can it see anything?


#5

Guys, thanks for help although now is definitely that base is not encrypted. Assumption is that something went wrong while recovering database because I don’t have idea how it could become encrypted automatically by it self … Also, inside a list of recovered files I found and “Baza.lns” (Baza,sqlite is origin name of database ) which doesn’t have sens to me.

Tried opening with “sqlite3” from sqlite.org but still getting error : File is encrypted or is not a database. After that, I tried opening it with XVI32 HEX editor. Also, opened few databases that work fine and found a big difference in header. The left one is the problematic one, on the right side are functional databases.

If you have any idea how to recover it, you would save my life :smiley:


#6

Also, when I try to run it using “sqlite3_analyzer” I get a message : " Database disk image is malformed"


#7

Hello @Goran_Klasic - Just to be clear, the file you referenced is not encrypted, it is corrupted. There is a big difference there. Unfortunately from your hexdumps it really looks like the header was completely overwritten. I’m not sure how it happened, but there appears to be path information written into the header, etc. Without the valid header information you are going to have a challenge reconstructing a usable database. You might be able to scroll down in the offending hex dump to see if there is any recognizable data later in the file. Do you have any backups of the database you could restore from?


#8

Ouch. Yeah… the recovery tool you used seems to be inaccurate.

Are you able to try recovering the file again, and maybe choose different options? Asking because what you have there is definitely not a working SQLite database file.

If there are different recovery tool options you can try, it’s probably worth doing that first to see if you can get a better result. :slight_smile:


#9

As a follow up, for anyone coming here via Google, these seem to be a widely regarded tools for recovery of deleted/damaged/etc SQLite databases:

http://sandersonforensics.com/forum/content.php?113-Software

Haven’t used them personally, but they look like the right kind of thing. :slight_smile:


#10

Hi @justinclift

Thanks for sharing, those could certainly be handy!