Recovering recent history from SQLite WAL files

Chrome and Firefox open their SQLite databases in WAL mode (write-ahead logging). New transactions are first appended to a <database>-wal sidecar file and only later checkpointed into the main .db/.sqlite file.

Why this matters

If you copy and parse only History (or places.sqlite) and ignore History-wal, you can silently miss the most recent visits, downloads and cookies — often exactly the activity an investigation cares about.

Do this

• Always collect the -wal (and -shm) sidecars alongside the main file.
• Keep them together and with the same base name.
• Merge the committed WAL frames into the database before querying.

How this tool handles it

Upload the whole profile folder (or both files together) and the parser automatically pairs History with History-wal, merges the committed pages into a consistent snapshot, then queries that — so recent records show up without any manual checkpointing. The same applies to Firefox's places.sqlite-wal.