Authors: Sueun Jung, Jungheum Park
DFRWS APAC 2026
Abstract
Page-level encryption is widely adopted to protect the confidentiality of SQLite databases, yet its effectiveness in preventing post deletion information leakage has not been systematically examined. Traditional carving and metadata-based approaches fail to restore encrypted or deleted records, and prior studies have largely focused on key acquisition rather than data reconstruction. To address this limitation, this study proposes WALRUS, a systematic recovery framework that identifies high-entropy clusters containing encrypted Write-Ahead Logging (WAL) fragments, merges distributed chunks, and reconstructs lost content from unal located space. Experimental validation demonstrates that WALRUS can reconstruct and decrypt large numbers of valid WAL pages from deleted encrypted remnants and export the records parsed from the recovered pages as analyzable artifacts, assuming that the corresponding decryption key has been obtained through independent forensic means.