When analyzing SQLite databases, the examiner might come across additional temporary files. There are nine types of temporary SQLite files:
Rollback, Master, and Statement journals
WALs
Shared-memory files
TEMP databases
Views and subqueries materializations
Transient indices and databases
For more details on these files, refer to https://www.sqlite.org/tempfiles.html, which describes these files in greater detail. WAL is one of those temporary files and is involved in the atomic commit and rollback scenarios. Only databases that have set their journaling mode to WAL will use the write ahead log method. The following code is required to setup the database to use WAL journaling.
PRAGMA journal_mode=WAL;
The WAL file is created in the same directory as the SQLite database with "-wal" appended to the original SQLite database filename. When a connection is made to the SQLite database, a WAL file is temporarily created. This WAL file will contain any changes made to the database while...