In this chapter, we will revisit SQLite databases and examine a type of journaling file called a Write Ahead Log (WAL). Due to the complexity of the underlying structure, parsing a WAL file is a more difficult task than our previous work with SQLite databases. There are no existing modules that we can leverage to directly interact with the WAL file in the same way we used sqlite3 or peewee with SQLite databases. Instead, we'll rely on the struct library and our ability to understand binary files.
Once we've successfully parsed the WAL file, we will leverage the regular expression library, re, in Python to identify potentially relevant forensic artifacts. Lastly, we briefly introduce another method of creating progress bars using the third-party tqdm library. With a few lines of code, we'll have a functioning progress bar that...
