Some temporary files may also be created, including Journal files and Write Ahead Logs. Journal files store original data before a transaction change so the database can be restored to a known state if an error occurs. They are created by default.
Write Ahead Logs (WAL) contain new data changes, leaving the original database untouched. This speeds up the database when multiple changes are made to the same table or row. After a set number of page changes, the WAL is used to update the actual database. Write Ahead Logs are optional.�
Journal files and Write Ahead Logs can be great sources of evidence and may or may not be supported by the forensic tools. Manual examination of these files using an appropriate forensics tool may be important. 1
Use of non-forensic SQLite viewing tools to try to view WAL files may not show you the data that exists within them but may instead show the live files from the current database (when the WAL is present), or the state of the database before the first transaction in the WAL, or just the records in the database without any of the changes in any of the transactions in the WAL. Using an appropriate forensic SQLite browser such as the Forensic Browser for SQLite (Sanderson Forensics), you can see all of the records from the DB along with all of the changes that have occurred, and often many copies of the same page comprising multiple transactions.
These files can be viewed within a Hex editor, carved for strings, or parsed by creating Python scripts that target application content.
Reference:
[1] https://for585.com/1baqh (SQLite.org)