O'Reilly logo

Practical Mobile Forensics - Second Edition by Satish Bommisetty, Rohit Tamma, Heather Mahalik

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Application data storage

Almost all applications rely on SQLite for data storage. These databases can be stored internally on the device or on the SD card for relevant phones. When SQLite is used, temporary memory files are commonly associated to each database to make SQLite more efficient. These files, which were previously mentioned, are write ahead logs (WAL) and shared memory files (SHM). These files may contain data that is not present in the SQLite database. Few tools will parse this information, but the ones that are offered by Sanderson Forensics, will get you started. Go to http://sandersonforensics.com/forum/content.php?261-Timelining-events-in-a-WAL-based-SQLite-DB. We can see several WAL and SHM files associated with various WhatsApp ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required