Expand description
Whole-database SQLite carver satisfying the fleet forensic_carve::Carver
contract (ADR 0001 §4).
A disk-unallocated or memory sweep hits the SQLite format 3\0 magic and
hands this carver a capped window starting at that magic. The carver validates
the 100-byte file header (magic, page size, in-header page count, reserved
space), bounds the database to page_size × page_count, and emits the bounded
byte range as a forensic_carve::CarvedItem that re-enters the normal
classify → parse pipeline. It is medium-agnostic: it echoes
CarveContext::recovery_method (so the same carver stamps UnallocatedCarve
on a disk sweep and MemoryCarve on a memory sweep) and never touches a
Read/Seek, a VFS handle, or a memory provider.
Header field offsets come from forensicnomicon::sqlite (the KNOWLEDGE leaf) —
the same constants sqlite-core’s reader parses, kept in one place. All reads
are bounds-checked; a window that fails validation emits nothing.
Structs§
- Sqlite
Carver - Whole-database SQLite carver (see the module docs).