Database forensic analysis through internal structure carving

Abstract

a b s t r a c tForensic tools assist analysts with recovery of both the data and system events, even from corrupted storage. These tools typically rely on "file carving" techniques to restore files after metadata loss by analyzing the remaining raw file content. A significant amount of sensitive data is stored and processed in relational databases thus creating the need for database forensic tools that will extend file carving solutions to the database realm. Raw database storage is partitioned into individual "pages" that cannot be read or presented to the analyst without the help of the database itself. Furthermore, by directly accessing raw database storage, we can reveal things that are normally hidden from database users. There exists a number of database-specific tools developed for emergency database recovery, though not usually for forensic analysis of a database. In this paper, we present a universal tool that seamlessly supports many different databases, rebuilding table and other data content from any remaining storage fragments on disk or in memory. We define an approach for automatically (with minimal user intervention) reverse engineering storage in new databases, for detecting volatile data changes and discovering user action artifacts. Finally, we empirically verify our tool's ability to recover both deleted and partially corrupted data directly from the internal storage of different databases.

Digital Forensic InnoDB Database Engine for Employee Performance Appraisal Application

“…Internal database investigation MariaDB requires knowledge to interpret every bit contained in each table in the database [4,8]. Digital forensic analysis is not possible without a good understanding of the properties of the MariaDB table [12].…”

“…The internal investigation includes checking the database engine which is the default used by MariaDB [4]. MariaDB stores all information on each table into the .frm file.…”

“…This information is crucial and is used as the main tool to make decisions about the performance of employees in the company [3]. Results and information on forensic databases can be used for several reasons [4,5]. First, find out how safe the data in the company is stored.…”

Implementing Chain of Custody Requirements in Database Audit Records for Forensic Purposes

“…First of all, reactive database forensics is comprised of bottom-up methods that adapt traditional digital forensics techniques for recovering scattered pieces of evidence in order to reconstruct the database state [7]. Examples of these methods are table-relationship analysis [8] and data file carving [9]. However, these methods either lack formalisation and scientific background [10], or may not be suitable for investigating databases [11].…”

Investigation and Automating Extraction of Thumbnails Produced by Image Viewers

“…It is possible to retrieve data from databases by other means. In the study of [24], some work has been done on recovering data from DBMS structures. Another subject to consider is compressed data within databases.…”