WAL
Definition
Write-Ahead Log, the SQLite journaling mode that writes new pages to a sibling .db-wal file before checkpointing them into the main database. Holds recent transactions that have not yet been merged.
- Stands for
- Write-Ahead Log
- System
- SQLite journaling mode
- File pattern
- Sibling .db-wal file
- Forensic value
- Holds recent transactions not yet checkpointed into the main DB
Common questions
Why does a SQLite WAL file matter for mobile forensics?+
The WAL can contain the most recent writes, including rows that have been deleted or updated in the main database file, so examiners who ignore the WAL and only parse the primary .db file can miss recently changed or recoverable data such as deleted messages.
How does WAL mode differ from SQLite's older rollback journal?+
In WAL mode new page versions are appended to the separate WAL file and readers can access the database concurrently with a writer, whereas the older rollback journal mode copies original pages out before overwriting them in place, which changes where recoverable artifacts end up on disk.
Related terms
- APK / IPA
- Android Package and iOS App Store package, the installable bundles for the two platforms. APK is a ZIP containing AndroidManifest.xml, classes.dex and...
- ART
- Android Runtime, the AOT-compiling successor to the Dalvik virtual machine since Android 5.0 Lollipop. Apps compile to OAT files on install for...
- FBE
- File-Based Encryption, the per-file key scheme that replaced Full-Disk Encryption (FDE) from Android 7.0 Nougat onward. Splits files into Credential Encrypted (CE)...
- Secure Enclave
- The dedicated security coprocessor on iPhone 5s and later, running a separate microkernel and holding the per-class encryption keys, the passcode verifier...
- TCC.db
- Transparency, Consent and Control database at /var/mobile/Library/TCC/TCC.db on iOS. Records which apps the user has granted access to camera, microphone, photos, contacts,...