We need to go back to SQLite for a minute here.
We need to talk about the temporary files that
may contain data that does not exist in the database yet.
And this is extremely important.
We already mentioned WAL.
And I think when I exported photos
that SQLite in Section 3, I said,
make sure you also grab the Write Ahead Log or the WAL
file because it will contain data that is not yet
in that database.
So we will find journal files.
We'll find write ahead logs.
These are often called WAL files.
They are going to contain content
or could contain content that is not
yet committed to that database.
And I'm going to walk you through what this looks like.
You will also find shared memory files.
These are temporary memory.
I can honestly tell you, I have not
find anything of forensic value in an SHM,
but just know that they exist.