title: SQLite3: Delete record without overwriting it with nullbytes
body: <p>According to this explanation[1] how it is possible to recover deleted records from an SQLite-database, two things happen when you delete a record: The area containing the deleted record is added to the free list (as a free block) and the "header" in the content area is overwritten.</p>
  
  <p>The content itself is not (or only a few bytes) overwritten, so e.g. by opening the database file with a hex editor you can still see parts of the deleted record.</p>
  
  <p>So to check whether this is true or not, here’s a minimal example:</p>
  
  <pre><code>sqlite3 example.db
  
  sqlite&gt; CREATE TABLE 'test'(aColumn VARCHAR(25));
  sqlite&gt; INSERT INTO test VALUES('AAAAAAAAAA');
  sqlite&gt; INSERT INTO test VALUES('BBBBBBBBBB');
  sqlite&gt; INSERT INTO test VALUES('CCCCCCCCCC');
  sqlite&gt; DELETE FROM test WHERE aColumn = 'BBBBBBBBBB';
  </code></pre>
  
  <p>What I’m expecting now is that – opening the file with a hex editor –  between CCCC… and AAAA… there are still some Bs (but some bytes before the Bs or the first few Bs should have been overwritten). 
  What really happens is that the whole area with Bs has been overwritten with nullbytes. </p>
  
  <p>This happens with larger databases, too. The content area is always cleaned with nullbytes and because of this it is impossible to recover anything.</p>
  
  <p>Is there any option or flag which I have to use to get the results shown in the blogpost? </p>
  
  <p>I need to create my SQLite-databases in that way, to be able to recover deleted records (or parts of them) with forensic tools. </p>
  
  <p>[1]<a href="http://sandersonforensics.com/forum/content.php?222-Recovering-deleted-records-from-an-SQLite-database" rel="nofollow">http://sandersonforensics.com/forum/content.php?222-Recovering-deleted-records-from-an-SQLite-database</a></p>