SQLite Rollback Journal
| Format | SQLite Rollback Journal |
|---|---|
| Short name | SQLite Journal |
| Category | database |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (SQLiteJournalParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Legacy (pre-WAL) companion file for a SQLite database in DELETE/TRUNCATE/PERSIST journal_mode. Holds the pre-transaction content of every page a still-open or crash-interrupted transaction touched, so SQLite can roll back an incomplete write on next open. Unlike -wal, this is the *old* page content, not the current one — forensically it means the opposite: the base database file's current on-disk pages for a hot journal's page numbers are the interrupted, never-committed write, and the journal itself holds what a proper rollback restores. A journal file present but with a zeroed/invalid header (PERSIST mode keeps the file after every commit but zeroes its header) is stale, not hot — it must not be rolled back, but the page records after the zeroed header may still hold older page versions until the next transaction overwrites them. Header (documented in the SQLite file format specification): 8-byte magic (d9 d5 05 f9 20 a1 63 d7), page-record count, checksum nonce, pre-transaction database size in pages, sector size, page size, then zero or more (page number + page content + checksum) records, possibly repeated across multiple header segments. Deleted rows and unallocated slack within a journaled page are recoverable the same way as in a live database page (freeblock chain, page-content-area gap).
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | D9 D5 05 F9 20 A1 63 D7 | .... .c. | SQLite rollback-journal magic |
Known extensions
-journal, .db-journal
References
- SQLite rollback journal format (SQLite file format specification, section 4.1) https://www.sqlite.org/fileformat2.html#rollbackjournal
- SQLite journal_mode pragma (DELETE, TRUNCATE, PERSIST, MEMORY) https://www.sqlite.org/pragma.html#pragma_journal_mode
- SQLite file format specification (main database, for page-level context) https://www.sqlite.org/fileformat.html
- What Hides in the WAL — SQLite Forensics with crush (beBinary) https://bebinary4n6.blogspot.com/2026/05/what-hides-in-wal-sqlite-forensics-with.html
Cite this entry
Crush Format Reference, “SQLite Rollback Journal”. https://kalink0.github.io/crush-forensics/formats/sqlite-journal/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction