When analyzing SQLite databases, the examiner might come across additional temporary files. There are nine types of temporary SQLite files:
- Rollback journals
- Master journals
- Statement journals
- WAL
- Shared-memory files
- TEMP databases
- Views and subqueries materializations
- Transient indices
- Transient databases
For more details on these files, refer to https://www.sqlite.org/tempfiles.html, which describes these files in greater detail. The WAL is one of these temporary files and is involved in the atomic commit and rollback scenarios. Only databases that have set their journaling mode to WAL will use the write ahead log method. The following SQLite command is required to configure a database to use WAL journaling:
PRAGMA journal_mode=WAL;
The WAL file is created in the same directory as the SQLite database with -wal appended to the original SQLite database filename...