It is not until a Checkpoint is reached (when the WAL has reached 1,000 pages in size or a command is issued by an application), that all of the data that was written to the WAL is then transferred to the main database.¹ This process does not alter the WAL, and the data within is left untouched. When the process begins again after the Checkpoint activity, the WAL is reused, and data is added back in sequentially.²

Because the WAL can hold up to 1,000 pages, it is a file that should not be overlooked in investigations.

You may have noticed that many of your analysis will reference source files where the data still exists in the WAL associated with the database. Also consider, if an application is encrypting content, sometime the data in the WAL and associated SHM files is in an unencrypted state.

References:

[1] https://for585.com/wal-analysis

[2] https://for585.com/sqlitewal