My iPhone has 16 notes. When I used a forensic tool to examine my phone, it recovered 27 notes, the 16 that I have and 11 "deleted" notes. All the "deleted" notes are named variations of 3 of the 16 notes. Each deleted note is a variation of the live note. I checked notes.sql db and although it only lists the 16 notes, I found the "deleted" portions at different offsets in the hex. My first thought was that the deleted notes were old / edited versions however, it seems that some of the deleted content has crossed from other notes or the note content is duplicated or tripled in the deleted portions. How does NotesApp deal with deleted/edited content from a note? Why is there "deleted" notes if they are still active? Any info would be appreciated.
1 Answer
It has to do with the storage format "sqlite" that is used by Notes.app. Sqlite is a very common storage format used by very many apps, and also for programs on desktop computers, in embedded systems, etc.
The "sqlite" format makes it possible to structure data to enable fast searching, updating, etc. However, it is organized in such a way that when an application delete data, it is actually not "erased" as such on disk. Instead smaller blocks of data are marked as non-used. When the user adds new data these smaller blocks are reused in order to improve performance and ensure that the on-disk file does not grow unlimited.
This is why you can see parts of deleted notes inside the file, and also why you can see parts of differents notes "cross each other" in the file. The file is simply not read by the app in a linear fashion (i.e. from start to end), but instead in terms of blocks in various patterns accounting for the various writes and deletes that happened to the file over time.
