Practical Mobile Forensics - Fourth Edition

iOS, Android, and Windows Phone application data storage

Almost all applications rely on SQLite for data storage. These databases can be stored internally on the device or the SD card for relevant phones. When SQLite is used, temporary memory files are commonly associated with each database to make SQLite more efficient. These files are rollback journals (JOURNAL), Write-Ahead Logs (WAL) and Shared Memory (SHM) files. These files may contain data that is not present in the SQLite database. We can see several WAL and SHM files associated with various WhatsApp database files in the following screenshot:

An SHM file and WAL example

In addition ...