Crate sqlite_forensic 

sqlite-forensic — Tier-2 anomaly auditor over sqlite_core.

WS-C skeleton. The reader (sqlite-core) answers “what does this database header show?”; this crate grades the forensically-notable observations into severity-ranked forensicnomicon::report::Findings, so a SQLite evidence database’s anomalies aggregate uniformly with the partition / container / filesystem layers.

Each anomaly is an observation (“consistent with …”); the examiner draws the conclusions.

Capabilities

• carve_deleted_records — recover deleted rows from free (unallocated) pages, the headline capability rusqlite structurally cannot provide. Each recovered row is confidence-graded, flagged allocated: false, and carries page/offset/rowid provenance.
• audit grades header reserved-space, a non-empty freelist (prior deletions), an active WAL overlay (uncheckpointed state), and a header/file page-count mismatch into severity-ranked forensicnomicon::report::Findings.

Deferred: a full anomaly suite (overflow-chain integrity, schema-format / text-encoding checks) and a fuzz harness.

Structs

Anomaly

A SQLite forensic anomaly: an observation graded by severity, with a stable code and note derived from its AnomalyKind so they cannot drift.

CarveTiers

The two strictly-separated recovery tiers returned by carve_with_fragments.

CarvedFragment

A Tier-2 partial recovery: a freed cell whose full row could not be reconstructed but at least one distinctive cell (TEXT ≥ 4 bytes of valid UTF-8, or REAL) survived at a structural anchor.

CarvedRecord

A deleted record recovered from unallocated space — the headline capability rusqlite cannot provide. Carries the decoded row plus provenance so the examiner can weigh it as a “consistent with a deleted row” observation.

OverflowProvenance

Provenance for a record reassembled across an overflow-page chain (task #73): the pages whose bytes were concatenated to recover the row. An examiner citing the row as evidence can name exactly where its bytes came from. Present only on chain-reassembled rows; None for every contiguous recovery.

WalProvenance

Provenance for a record carved from a -wal frame: the (salt1, salt2, frame_index) log-sequence identity of the frame it came from (the LSN task #55 will formalize).

Enums

AnomalyKind

The classified SQLite forensic anomalies this auditor can grade.

RecoverySource

Which class of free space a deleted record was carved from. Records the recovery provenance so the examiner can weigh reliability by class.

Functions

audit

Audit an opened Database for forensically-notable anomalies.

audit_carved_findings

Carve deleted records and convert each to a canonical Finding under source. The per-record confidence is threaded into the finding’s context so downstream consumers can filter low-confidence recoveries.

audit_findings

Audit an opened Database and convert each anomaly to the canonical Finding under the supplied Source, ready to merge into a Report.

carve_all_deleted_records

Recover deleted records across every free-space class — the full-coverage carver. Drives, in order:

carve_at_commit

Carve the deleted residue of one materialized commit snapshot of the -wal, the per-commit temporal building block of the N-snapshot carve.

carve_deleted_records

Recover deleted records by carving the database’s free (unallocated) pages.

carve_with_fragments

Two-tier deleted-record recovery: Tier-1 full rows plus Tier-2 partial fragments, in one pass.