1009731 - Not a bug, but please help - I can't locate the places.sql-wal in firefox 28.0. My understanding of earlier versions is that it should be in the profile directory, but in 28.0 there are no WALs in the directory. many thanks.

Status: RESOLVED INVALID

(Firefox :: Untriaged, defect)

Description

[Josh Harrison]

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20100101 Firefox/22.0 (Beta/Release)
Build ID: 20130618035212

Steps to reproduce:

I'm trying to conduct a forensic examination of deleted entries from the places.sqlite db (mainly the moz_places table). Obviously when an record is deleted it is zero-filled. I am trying to ascertain where the WAL will contain forensically retrievable records which don't show in the place.sqlite db. 


Actual results:

My research for previous releases led me to belive that the wal file should be in the same directory as its linked db, however for firefox 28.0 there are no wals in the profiles directory. can anyone point me in the right direction as to whether these wals would contain forensically useful data, and if so where can they be located?

Comment 1

[:Gijs (he/him)]

AIUI, these files can be removed by sqlite at its sole discretion. If you need more information, please use our mailing lists: https://groups.google.com/forum/?fromgroups#!forum/mozilla.dev.platform is probably a reasonable choice for this question.