In more detail
SQLite is a small database engine that keeps an entire database in one ordinary file, with no server process. It is built into phones, browsers and countless applications. The file is divided into fixed-size pages, usually 4,096 bytes, and every SQLite file begins with the 16-byte text SQLite format 3 followed by a zero byte. Chrome keeps its browsing history in a SQLite file named History, and Firefox uses places.sqlite. Deleted rows often survive in free pages until they are overwritten, so a forensic parser can recover entries that the browser no longer shows. A companion -wal file may hold recent changes not yet merged into the main file. See the browser forensics tool.
Why it matters
Because so much app data lives in SQLite, it is a core forensic artefact: history, cookies, messages and downloads. Copying only the main file and ignoring the -wal file can miss the newest records, and opening the original in a normal client can modify it, so work on a copy.
Example
The first 16 bytes of any SQLite file are 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00, which is SQLite format 3 plus a null; bytes 16 and 17 hold the page size, 10 00 meaning 4,096. Timestamps use different epochs. A Chrome last_visit_time of 13350000000000000 is microseconds since 1601 and means 2024-01-17 21:20:00 UTC, while a Firefox visit_date of 1760000000000000 is microseconds since 1970 and means 2025-10-09 08:53:20 UTC. The Cookie store and File carving are related topics.