WALRUS: Reconstructing deleted and encrypted SQLite WAL pages from unallocated space

Abstract

Page-level encryption is widely adopted to protect the confidentiality of SQLite databases, yet its effectiveness in preventing post-deletion information leakage has not been systematically examined. Traditional carving and metadata-based approaches fail to restore encrypted or deleted records, and prior studies have largely focused on key acquisition rather than data reconstruction. To address this limitation, this study proposes WALRUS, a systematic recovery framework that identifies high-entropy clusters containing encrypted Write-Ahead Logging (WAL) fragments, merges distributed chunks, and reconstructs lost content from unallocated space. Experimental validation demonstrates that WALRUS can reconstruct and decrypt large numbers of valid WAL pages from deleted encrypted remnants and export the records parsed from the recovered pages as analyzable artifacts, assuming that the corresponding decryption key has been obtained through independent forensic means.