Application data storage

Almost all applications rely on SQLite for data storage. These databases can be stored internally on the device or on the SD card for relevant phones. When SQLite is used, temporary memory files are commonly associated to each database to make SQLite more efficient. These files, which were previously mentioned, are write-ahead logs (WAL) and shared memory files (SHM). These files may contain data that is not present in the SQLite database. Few tools will parse this information, but the ones that are offered by Sanderson Forensics will get you started. Go to http://sandersonforensics.com/forum/content.php?261-Timelining-events-in-a-WAL-based-SQLite-DB for more information. We can see several WAL and SHM files associated with various WhatsApp database files in the following screenshot:

An SHM file and WAL example

In addition to SQLite databases, other devices...