If you have an app and you're trying to open it,
or you want to make sure that someone didn't just send you
a database and you need a WAL, what you can do is look
at bytes offset 18 and 19 and see if they are 01 or 02.
I'm going to show you how to do this inside of the VM.
I'm going to open DB browser for SQLite.
And I'm just going to open one of the databases I previously
exported.
I will open Photos.sqlite.
So if you're looking in here, you're
not going to see anything that's telling you if it has a WAL
or not.
So what I want to do is I'm going to close this,
and I'm going to open a hex editor.
We have a free one in the VM.
It's called Fred.
And I'm just going to drag that same database in.
Now, what we can do--
I'm going to zoom in here.
We see SQLite format 3.
And then, what you want to look at are bytes 18 and 19.
We have 02 02.
If it's 02 02, a write ahead log belongs with that file.
If it's 01 01, journaling is in use.
So let's take a look at another one.
Let's look at health.
Nope, that's not a database.
Let's look at-- let's see if I can randomly select one
that's not going to be 02 02.
Excellent.
I got lucky on this one.
Bytes 18 and 19--
oh, sorry-- 01 01, journaling.
So we're going back to the slide now,
and I just want to review it one more time.
If you see, at offset 18 and 19, that 01 01 journaling is
in use.
And if you see 02 02, write ahead log is in use.
If you see that it's write ahead log,
you need to have that write ahead log either
in your forensic file system extraction,
and then it will pass normally.
But if you export it, they must be in the same directory
together to fully piece them back together.