Yesterday I accidentally deleted an SMS banking notification thread on my Android device.

A classic case: I didn't backup the messages for very long time.

After flashing the recovery and rooting the device I pulled the mmssms.db SQLite3 database along with its -shm and -wal files. Inspecting the contents of the database didn't give a chance to recover the messages: neither the threads nor the sms tables provide a "soft deletion" column, so the messages are deleted from the database physically.

However, grepping for the banking notification text in the -wal file resulted in very many occurrences of the notification plain text so I'm sure: the data is locked there somehow. Opening the database using sqlite3 merely deletes the -wal file.

I'm wondering: is it possible to extract the data out of the -wal file or rollback the deletion (at least for both threads and sms tables) merging the deleted contents back to the mmssms.db database?

  • Check the WAL contents: does it contain valid frames? – CL. Dec 12 '19 at 11:04
  • @CL. I believe so. There was no crash at the time of the accident, so I believe both the database its WAL/SHM are not corrupted. Is there probably a tool to inspect the WAL contents? – fluffy Dec 13 '19 at 18:18
  • No. You have to go at it with a hex editor, or pay somebody else. – CL. Dec 13 '19 at 18:58
  • @CL. Ok, let's suppose I implement the tool to verify the WAL contents integrity myself. What then? – fluffy Dec 13 '19 at 19:24
  • The WAL file contains the changed pages of all transactions since the last checkpoint. Removing some frames essentially reverts those transactions. – CL. Dec 13 '19 at 19:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.