InnoDB database forensics: Enhanced reconstruction of data manipulation queries from redo logs

Frühwirt, Peter; Kieseberg, Peter; Schrittwieser, Sebastian; Huber, Markus; Weippl, Edgar

doi:10.1016/j.istr.2013.02.003

Cited by 26 publications

(14 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The study by [25] focused on Data Manipulation Language (DML) statements and overlooked Data Definition Language (DDL) declarations. Previous reconstruction models were enhanced by [26], including DDL reconstruct statements. Additionally, the technical investigation model suggested by [27] showcased admittance for a user's MySQL database without the need for user assistance.…”

Section: Background and Related Workmentioning

confidence: 99%

Database Forensic Investigation Process Models: A Review

et al. 2020

View full text Add to dashboard Cite

Database Forensic Investigation (DBFI) involves the identification, collection, preservation, reconstruction, analysis, and reporting of database incidents. However, it is a heterogeneous, complex, and ambiguous field due to the variety and multidimensional nature of database systems. A small number of DBFI process models have been proposed to solve specific database scenarios using different investigation processes, concepts, activities, and tasks as surveyed in this paper. Specifically, we reviewed 40 proposed DBFI process models for RDBMS in the literature to offer up-to-date and comprehensive background knowledge on existing DBFI process model research, their associated challenges, issues for newcomers, and potential solutions for addressing such issues. This paper highlights three common limitations of the DBFI domain, which are: 1) redundant and irrelevant investigation processes; 2) redundant and irrelevant investigation concepts and terminologies; and 3) a lack of unified models to manage, share, and reuse DBFI knowledge. Also, this paper suggests three solutions for the discovered limitations, which are: 1) propose generic DBFI process/model for the DBFI field; 2) develop a semantic metamodeling language to structure, manage, organize, share, and reuse DBFI knowledge; and 3) develop a repository to store and retrieve DBFI field knowledge. INDEX TERMS Database forensic, digital forensic, investigation process model.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

Database Forensic Investigation Process Models: A Review

et al. 2020

View full text Add to dashboard Cite

show abstract

“…If the investigators use conventional methods, it is difficult to find and access relevant data case at the first time [9]. The research on database forensics mainly includes the following aspects: 1) Database forensics technology focusing on the database recovery, operation log forensics process, such as Al-Dhaqm defines a model from the identification, collection, storage, analysis process and record database of digital evidence, reconstruction [10]; Fasan & Fruhwirt restored data approach to obtain evidence through a database query log reconstruction [11,12]. 2) For more complicated and huge data, data mining model is helpful for assisting investigators to find out the law of circulation.…”

Section: Realted Workmentioning

confidence: 99%

A Method of Mining Key Accounts from Internet Pyramid Selling Data

2019

Teh. vjesn.

View full text Add to dashboard Cite

Internet pyramid selling causes great harm and has difficulty in obtaining evidence. As most of internet pyramid selling often uses virtual coins to complete cash settlement, criminals can exchange virtual coins by controlling visual accounts to transfer funds illegally. The purpose of the work is to mine the key accounts and build evidence chain of personnel and funds. In order to deal with a large number of transaction data, we characterize the virtual currency trading data, which is divided into seven transaction characteristics. The key accounts are these outliers which have too prominent trading behaviour. So we use positive samples to train One Class Support Vector Machine (OCSVM) classification to find trading behaviours' boundary and detect outliers in classification. Then, the correlation between member's information and pyramid selling hierarchical relationship can also be obtained by further linking the trading behaviour of key accounts. Finally, we can screen out the virtual accounts directly controlled by the pyramid selling organization, analyse the flow of funds, investigate and obtain evidence on amount of money involved in pyramid selling. The experimental results show that the classification model cannot only establish the normal model for account transfer behaviour, but also effectively identify abnormal transfer behaviour, thus improving efficiency of investigation and evidence collection for economic investigation departments.

show abstract

“…Internal mechanisms for guaranteeing database correctness and providing rollback functionality have been used for forensic purposes [4,5].…”

Section: Background and Related Workmentioning

confidence: 99%