The process for calculating a checksum text on the SQLite file format page contains two errors.
Currently reads: The checksum is an unsigned 32-bit integer computed as follows: 1. Initialize the checksum to the checksum nonce value found in the journal header at offset 12. 2. Initialize index X to be N-200 (where N is the size of a database page in bytes. 3. Interpret the four bytes at offset X into the page as a 4-byte big-endian unsigned integer. Add the value of that integer to the checksum. 4. Subtrace 200 from X. 5. If X is greater than or equal to zero, go back to step 3. The source states: ** This is not a real checksum. It is really just the sum of the ** random initial value (pPager->cksumInit) and every 200th byte ** of the page data, starting with byte offset (pPager->pageSize%200). ** Each byte is interpreted as an 8-bit unsigned integer. Should read somethng like: The checksum is an unsigned 32-bit integer computed as follows: 1. Initialize the checksum to the checksum nonce value found in the journal header at offset 12. 2. Initialize index X to be N-200 (where N is the size of a database page in bytes. 3. Interpret the* byte* at offset X into the page as *an 8-bit* unsigned integer. Add the value of that integer to the checksum. 4. Subtrac*t* 200 from X. 5. If X is greater than or equal to zero, go back to step 3. Paul www.sandersonforensics.com skype: r3scue193 twitter: @sandersonforens Tel +44 (0)1326 572786 http://sandersonforensics.com/forum/content.php?195-SQLite-Forensic-Toolkit -Forensic Toolkit for SQLite email from a work address for a fully functional demo licence _______________________________________________ sqlite-users mailing list sqlite-users@mailinglists.sqlite.org http://mailinglists.sqlite.org/cgi-bin/mailman/listinfo/sqlite-users
