# Recover deleted records from encrypted Sqlite db

**URL:** <https://discuss.zetetic.net/t/recover-deleted-records-from-encrypted-sqlite-db/3986>\
**Category:** Uncategorized\
**Created:** [October 12, 2019, 1:42pm UTC](https://discuss.zetetic.net/t/recover-deleted-records-from-encrypted-sqlite-db/3986 "2019-10-12T13:42:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![anonkash12](https://avatars.discourse-cdn.com/v4/letter/a/edb3f5/32.png) [@anonkash12](https://discuss.zetetic.net/u/anonkash12)\
**Post date:** [October 12, 2019, 1:42pm UTC](https://discuss.zetetic.net/t/recover-deleted-records-from-encrypted-sqlite-db/3986/1 "2019-10-12T13:42:21Z")

</div>

Is there a way of recovering deleted records from a sqlite db file which is encrypted. The password is known. Is there a tool or script available which will enable me to extract the records deleted from the db (encryption key known)?

I tried to use tools viz. undark, sqlite forensics recovery etc but they do not support encrypted dbs. I also went through [`https://linuxsleuthing.blogspot.com/2013/09/recovering-data-from-deleted-sqlite.html`](https://linuxsleuthing.blogspot.com/2013/09/recovering-data-from-deleted-sqlite.html) but could not extract the deleted records.

---

<div class="post-metadata">

**Author:** ![sjlombardo](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/sjlombardo/32/3_2.png) [@sjlombardo](https://discuss.zetetic.net/u/sjlombardo)\
**Post date:** [October 13, 2019, 3:43pm UTC](https://discuss.zetetic.net/t/recover-deleted-records-from-encrypted-sqlite-db/3986/2 "2019-10-13T15:43:46Z")

</div>

Hello @anonkash12 - SQLCipher deliberately protects against forensic analysis of deleted data by enabling [secure delete](https://www.sqlite.org/pragma.html#pragma_secure_delete). This causes freed pages to be zeroed out on delete to hinder recovery.