While none of the active database tables contained the actual deleted messages, using the information contained in deleted_chm, the deleted content was easily recovered from the raw database file.

In the example above, the stanza_id information contained in deleted_chm was used to conduct a simple search across the entire database (in Hex view), which uncovered the deleted content associated with the stanza_id ending in ”8104.”

To simplify the search, we took the last four digits of the stanza_id, “8104,” and conducted a search across the entire raw database file. A review of the search hits showed that deleted content immediately followed the stanza_id.

While this exact technique will not work for every application, it is a simple illustration on how to search for items that could still exist in the database.