Assembling Metadata for Database Forensics

Abstract

Since information is often a primary target in a computer crime, organizations that store their information in database management systems (DBMSs) must develop a capability to perform database forensics. This paper describes a database forensic method that transforms a DBMS into the required state for a database forensic investigation. The method segments a DBMS into four abstract layers that separate the various levels of DBMS metadata and data. A forensic investigator can then analyze each layer for evidence of malicious activity. Tests performed on a compromised PostgreSQL DBMS demonstrate that the segmentation method provides a means for extracting the compromised DBMS components.

Towards a forensic-aware database solution: Using a secured database replication protocol and transaction management for digital investigations

“…The papers featured covered a range of topics relating to database forensics. Beyers et al discussed the creation of a method to separate the different layers of data and metadata to prepare a database management system for forensic examination (Beyers et al, 2011). In a similar vein, Fasan et al demonstrated how a database reconstruction algorithm can be utilized to reconstruct a database allowing an examination to be performed (Fasan and Olivier, 2012a, b).…”

A Method of Mining Key Accounts from Internet Pyramid Selling Data

“…Moreover, there is a large amount of extremely critical data stored in the database; the suspects often disguise the key fields and the data of the website. If the investigators use conventional methods, it is difficult to find and access relevant data case at the first time [9]. The research on database forensics mainly includes the following aspects: 1) Database forensics technology focusing on the database recovery, operation log forensics process, such as Al-Dhaqm defines a model from the identification, collection, storage, analysis process and record database of digital evidence, reconstruction [10]; Fasan & Fruhwirt restored data approach to obtain evidence through a database query log reconstruction [11,12].…”

Schema Reconstruction in Database Forensics

“…A compromised database is a database in which some metadata or DBMS software have been modified by an attacker although the database may still be operational. Olivier [14] and Beyers, et al [2] have pointed out that, although a database itself may be the best tool for collecting data for forensic analysis of the database, the integrity of the results obtained cannot be guaranteed because the database could have been modified into giving false information. Litchfield [12] also identified this problem when discussing the steps for performing a live response to an attack on an Oracle database.…”

“…Database forensics is the branch of digital forensics [11,15] that deals with the identification, preservation, analysis and presentation of evidence from databases [8]. Over the past few years, researchers [2,14] have emphasized the need to incorporate database forensic analysis as part of traditional digital forensics due to the amount of information that is often retrieved from a database during an investigation. Although considerable research has been conducted in the area of database forensics, much work remains to be done with regard to formalizing the database forensic process.…”

“…One aspect of database forensics that has not yet been considered deals with the reconstruction of the database schema or metadata. Although the importance of the database schema has been discussed in the database forensic literature [2,5,7,12], no method currently exists for reconstructing a database schema.…”