SQLite WAL

Format	SQLite WAL
Short name	SQLite WAL
Category	database
Platforms	Windows, macOS, Linux, iOS, Android, QNX
Crush support	Supported `(SQLiteWALParser)`
Status	Reviewed
Last reviewed	2026-10-04

Forensic relevance

Write-Ahead Log companion file for SQLite databases in WAL journal mode. Contains uncommitted database pages and, after checkpoint, WAL slack — old page versions that persist until overwritten from the start of the file. Must be analysed alongside the parent database file using the same schema. CRITICAL: opening the parent database with a standard SQLite driver triggers a checkpoint, committing and clearing the WAL — use read-only forensic tools only. Without the companion database, frames can still be decoded, but column names are only available from the schema. See SQLite Database entry for full forensic context.

Signatures

Offset	Hex	ASCII (non-printable as .)	Description
offset 0 (0x0)	37 7F 06 82	7...	SQLite WAL magic 0x377F0682 (checksums computed little-endian)
offset 0 (0x0)	37 7F 06 83	7...	SQLite WAL magic 0x377F0683 (checksums computed big-endian)

Known extensions

-wal

References

SQLite WAL file format (SQLite file format specification, section 4) https://www.sqlite.org/fileformat2.html#walformat
SQLite WAL-mode file format — WAL-index and locking https://www.sqlite.org/walformat.html
Forensic examination of SQLite Write Ahead Log files (Sanderson Forensics) https://sqliteforensictoolkit.com/forensic-examination-of-sqlite-write-ahead-log-wal-files/
What Hides in the WAL — SQLite Forensics with crush (beBinary) https://bebinary4n6.blogspot.com/2026/05/what-hides-in-wal-sqlite-forensics-with.html

Cite this entry

Crush Format Reference, “SQLite WAL”. https://kalink0.github.io/crush-forensics/formats/sqlite-wal/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.

Entry in the source at this commit · Change history of the source · Report a correction