Database Application Schema Forensics

Abstract

<jats:p>The application schema layer of a Database Management System (DBMS) can be modified to deliver results that may warrant a forensic investigation. Table structures can be corrupted by changing the metadata of a database or operators of the database can be altered to deliver incorrect results when used in queries. This paper will discuss categories of possibilities that exist to alter the application schema with some practical examples. Two forensic environments are introduced where a forensic investigation can take place in. Arguments are provided why these environments are important. Methods are presented how these environments can be achieved for the application schema layer of a DBMS. A process is proposed on how forensic evidence should be extracted from the application schema layer of a DBMS. The application schema forensic evidence identification process can be applied to a wide range of forensic settings.</jats:p>

Digital Forensics Readiness Framework (DFRF) to Secure Database Systems

“…Several studies have argued that database security models might fail when applied [6][7][8][9][10][11]. DBMSs differ greatly in terms of functionality, which may explain this failure.…”

“…However, this model could not detect when tampering occurred, which data were altered, and the identity of the attacker, as it was not able to analyze intruder activities. In [7], a model was introduced to investigate compromised databases by involving two examination processes: identification and collection. In [27], a method was presented to collect, preserve, and analyze database metadata to prevent attacks on databases using four investigation processes: collecting and preserving evidence, analyzing anti-forensic attacks, analyzing database attacks, and preserving evidence reports.…”

Development and validation of a Database Forensic Metamodel (DBFM)

“…For example, in a System and Method for Investigating a Data Operation Performed on a Database [ 23 ], the terminology ‘ Reconstructing Database’ is used to reconstruct the database events from logs and memory caches. The same activity, however, is represented using ‘ Rebuilding’ in the Database Application Schema Forensics Model [ 29 ]. A specific domain modelling language expressed as a metamodel can offer an alternative and better approach towards resolving this type of problem.…”

“…Additionally, Litchfield offered series of technical models [ 25 , 34 – 39 ] to deal with several specific incidents, cases and scenarios of Oracle database. Furthermore, several studies such as [ 1 – 3 , 22 , 24 , 26 , 27 , 29 , 40 – 66 ], discussed Database Forensic from technology perspectives. For example, methods to detect database tampering, detect covert database server, discovering who is criminal, when crime happen, what and where crime happen, protect evidence methods, acquisition methods, analysis methods, forensic analysis algorithms, etc.…”

Notions of Hypothesis in Digital Forensics

“…At this point, one of the methodological weaknesses in the current meta-theory of digital forensics has been reached. Whereas the word "hypothesis" is already in wide use (see, e.g., [2]), it is mainly used in an undifferentiated and science-philosophically unreflected manner. This suggests that users of the concept are largely unaware of the many different classes of empirical hypotheses.…”