how to fix malform...
 
Notifications
Clear all

how to fix malformed contasts2.db

9 Posts
2 Users
0 Likes
1,046 Views
(@stetocina)
Posts: 28
Eminent Member
Topic starter
 

I have dead htc desire. With JTAG I read image and extract contacts2.db but when I tray extract phonebook to vcf database I get the message "disk image is malformed" Can it be repaired?

 
Posted : 29/10/2012 12:40 pm
(@alexc)
Posts: 301
Reputable Member
 

Some SQLite clients have repair functions which might work. SQLite Expert has such a function and there's a 30-day trial version http//www.sqliteexpert.com/

But I would be interested in how you extracted it in the first place- how did you rebuild the file? Did you rebuild the YAFFS file system or simply carve it?

 
Posted : 29/10/2012 2:38 pm
(@stetocina)
Posts: 28
Eminent Member
Topic starter
 

Some SQLite clients have repair functions which might work. SQLite Expert has such a function and there's a 30-day trial version http//www.sqliteexpert.com/

But I would be interested in how you extracted it in the first place- how did you rebuild the file? Did you rebuild the YAFFS file system or simply carve it?

I rebuild YAFFS file sysstem

 
Posted : 29/10/2012 3:03 pm
(@alexc)
Posts: 301
Reputable Member
 

If that completed correctly you shouldn't really be seeing that error - unless there was an error during the last write to the file. Were there any "-journal" or "-wal" files alongside the database file? Also, what are you using to view it?

 
Posted : 29/10/2012 7:50 pm
(@stetocina)
Posts: 28
Eminent Member
Topic starter
 

I found some "-journal" or "-wal" files but I do not now what can I do with this files.
For view db I use sqlite3 from Santoku linux

 
Posted : 30/10/2012 11:41 am
(@alexc)
Posts: 301
Reputable Member
 

Which version of sqlite is included in Santoku? (The version is reported when you first launch it).

The journal and WAL files are for ensuring that databases don't become corrupt if write operations aren't completed.

If there is a contacts2.db-journal or contacts2.db-wal file in the same logical directory as the database in the image, just extract it into the same directory as your contacts db before you open it.

Some other information about these files
http//sqlite.org/fileformat2.html (sections 3 and 4)
http//digitalinvestigation.wordpress.com/2012/05/04/the-forensic-implications-of-sqlites-write-ahead-log/ (a blog post I wrote about the WAL (Write Ahead Log) and the implications it can have during the examination of SQLite databases)

 
Posted : 30/10/2012 3:33 pm
(@stetocina)
Posts: 28
Eminent Member
Topic starter
 

SQlite version 3.7.9 2011-11-01 also I tray with Sqliteman v1.2.2

In same directory with contacts2.db I have contacts2.db-mj4A646F30 1KB size.

When I open this file in txt editor I have this text

" /data/data/com.android.providers.contacts/databases/contacts2.db-journal "

 
Posted : 30/10/2012 7:44 pm
(@alexc)
Posts: 301
Reputable Member
 

Not sure off the top of my head what contacts2.db-mj4A646F30 is, could well be something generated by the YAFFS rebuilding process though?

Have you tried the repair functionality in SQLite Expert that I mentioned in my first post?

 
Posted : 31/10/2012 3:29 pm
(@stetocina)
Posts: 28
Eminent Member
Topic starter
 

With Sqlite expert I have call list, and some of contacts

 
Posted : 06/11/2012 12:46 pm
Share: