Skip to content
Timelineparser

Glossary

SQLite freelist

The list of unused pages in a SQLite database. Deleted rows can survive in free pages and freeblocks until they are reused or the file is vacuumed.

When rows are deleted, SQLite does not necessarily erase their bytes. Whole pages that become unused go on the freelist; free space inside a page is tracked as freeblocks (SQLite file format). Unless secure_delete is enabled or the database is rebuilt with VACUUM, old content may remain.

Carving these structures, together with stale WAL frames, is how deleted ActivitiesCache.db records are recovered (Meng and Baier, 2019). See Windows Timeline limitations and anti-forensics.