Recovering deleted SQLite records
SQLite databases store the deleted records within the database itself, so it is possible to recover deleted data, such as contacts, SMS, calendar, notes, e-mail and voicemail, and more by parsing the corresponding SQLite database. If a SQLite database is vacuumed or defragmented, the likelihood of recovering the deleted data is minimal. The amount of cleanup that these databases require relies heavily on the iOS version, the device, and the user's settings on the device.
A SQLite database file comprises one or more fixed size pages, which are used just once. SQLite uses a b-tree layout of pages to store indices and table content. Detailed information on the b-tree layout is explained at http://sandbox.dfrws.org/2011/fox-it/DFRWS2011_results/Report/Sqlite_carving_extractAndroidData.pdf.
Commercial forensic tools provide support to recover deleted data from SQLite database files, but they don't always recover all of the data, nor do they support...