Make sure to get yourself well acquainted with Disk Drill’s data protection methods before proceeding with this article. Some users are wondering what the two files are and how they are used by Disk Drill. We’ll try to give a little insight here.
live.db and dead.db are the artifacts of Recovery Vault module in Disk Drill. These files contain folder and file names, size, last modification time and on-disk location for files in tracked folders. By default the whole ‘/Users’ folder is monitored, but that is customizable by Disk Drill user in Data Protection settings.
Disk Drill uses live.db to store the more or less fresh snapshot of real non-deleted files in the tracked folders. When Disk Drill detects deletion of a file, it moves the file information from live.db to dead.db. Then dead.db is used to restore deleted files when possible.
If you work for law enforcement or a forensic agency, we might be able to provide an interface to these files assuming proper level of privacy protection of our end-users.