Glossary
Write-ahead log (SQLite WAL)
The -wal file where SQLite appends committed pages before a checkpoint copies them into the database; on Windows 11 it holds the newest index data.
In WAL mode, SQLite does not modify the database file on commit. It appends the changed pages as frames to a -wal file, and readers take the newest committed frame for each page. A checkpoint later copies pages back into the database, by default when the WAL reaches 1,000 pages or the last connection closes, per the SQLite documentation.
For the Windows 11 search index, Windows.db-wal therefore holds the most recent indexing work. Comparing the database with and without it reveals recently added, changed or removed items. Opening the original in a normal SQLite client can checkpoint and reset it. See Windows.db forensics.