If you are using commercial tools to conduct analysis, the guesswork of determining whether or not the content was written into temporary memory already has most likely been handled by the tool, but if you are working with more obscure databases that may not have been decoded by your tool of choice or you enjoy manually reviewing databases, this determination can be important to retrieving all of the available data.

First, determine if the database you are examining is using journaling or Write Ahead Logs as the mechanism for storing temporary data. The SQLite header for every database file will contain these offsets to differentiate between the two:¹

  •  File Offset 18 (1 byte) 01: Legacy Journal

  •  File Offset 19 (1 byte) 01: Legacy Journal

OR

  •  File Offset 18 (1 byte) 02: WAL

  •  File Offset 19 (1 byte) 02: WAL

*To count the offsets, the first byte is 0.

Reference:

[1] https://for585.com/database-format