Skip to content
NotificationPARSER

Glossary

WAL checkpoint

The SQLite operation that copies committed pages from the -wal file back into the main database file, after which the WAL can be reset.

A checkpoint is the SQLite operation that transfers the content of the write-ahead log back into the main database file. For every page changed by a committed transaction, it writes the latest version from the -wal file over the page in the database file. Once every frame has been copied, the next writer can start the WAL again from the beginning with new salt values, overwriting the old frames as it goes (sqlite.org).

SQLite runs checkpoints on its own. By default one runs automatically once the WAL grows past about 1,000 pages, and when the last connection to a database closes, SQLite normally checkpoints and deletes the -wal file. Applications can also request one explicitly, in passive, full, restart or truncate mode.

Why it matters in investigations

Before a checkpoint, the database file and the WAL together hold more history than either alone: the file keeps page images as they were at the last checkpoint, and the WAL keeps successive newer versions. Both can contain notification rows that the current state no longer has. A checkpoint overwrites the old page images in the file and, eventually, the old WAL frames.

That is why simply opening an evidence copy of wpndatabase.db in a SQLite browser is risky: closing it may checkpoint and remove the WAL, destroying the newest notifications' separate copy and the older page versions used for recovery. Hash the originals, work on copies, and use a reader that never writes.

Example

Before:  wpndatabase.db      (state at last checkpoint)
         wpndatabase.db-wal  (frames for pages 4, 5, 4, 9 ...)
Open + close in a SQLite tool
After:   wpndatabase.db      (pages 4, 5, 9 rewritten)
         wpndatabase.db-wal  (gone, or reset)

The parser does the opposite: it overlays committed WAL frames in memory, reports rows found only in the WAL, and leaves both files untouched.

Use the read-only Windows Notification Parser, and see the acquisition guide for collecting the database and its WAL safely.