MOBILE FORENSICS
WAL and SHM Analysis – Unassuming files of great significance to IT forensics
TECHNICAL BACKGROUND
Technical Fundamentals
Many modern apps use SQLite. Messaging apps often store their data in one or more SQLite databases. If these databases are running in WAL mode, the WAL file may contain additional information that had not yet been transferred to the actual database at the time the backup was taken. For this reason, in a professional IT forensic investigation – where available – the main database, WAL file and SHM file are always examined together.
TYPICAL QUESTIONS
When is this analysis required?
LIMITATIONS & CONCLUSION
What you should know
Not every WAL or SHM file contains additional information relevant to forensic analysis – whether such data is present, and if so what kind, depends on the time of the backup and the usage patterns of the app in question. However, if these files are overlooked or backed up without the associated main database, important information may be irretrievably lost. For this reason, we always examine WAL and SHM files in conjunction with other artefacts and document in a transparent manner what information can actually be derived from them.
CUSTOMER REVIEWS
What our customers say
4.8 out of 5 stars on Trustpilot · 54 reviews
“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”
idalein
Verified review on Trustpilot
“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”
Layla Pankratz
Verified review on Trustpilot
“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”
a woman from Cologne
Verified review on Trustpilot
Enquire now – free initial consultation
Do you have any questions? Please contact us for a free initial consultation.
RELATED TOPICS
You might also be interested in
FREQUENTLY ASKED QUESTIONS
Frequently Asked Questions
Click on a question to see the answer.