InnoDB Database Forensics: Reconstructing Data Manipulation Queries from Redo Logs

Abstract

Abstract-InnoDB is a powerful open-source storage engine for MySQL that gained much popularity during the recent years. This paper proposes methods for forensic analysis of InnoDB databases by analyzing the redo logs, primarily used for crash recovery within the storage engine. This new method can be very useful in forensic investigations where the attacker got admin privileges, or was the admin himself. While such a powerful attacker could cover tracks by manipulating the log files intended for fraud detection, data cannot be changed easily in the redo logs. Based on a prototype implementation, we show methods for recovering Insert, Delete and Update statements issued against a database.

Security and Privacy Implications on Database Systems in Big Data Era: A Survey

“…ACID compliant databases use on-disk log files in order to facilitate roll-back operations for most recent transactions. By using standard forensic techniques, these log files can be used to reconstruct the past query transactions issued on the database [67]. Furthermore, in [68] Grubbs et al revealed that the timing of queries carries sensitive information which can be extracted from log files that support replicated transactions.…”

Towards a forensic-aware database solution: Using a secured database replication protocol and transaction management for digital investigations

“…Every change in the file system will cause at least one log entry that basically consists of a header with a dedicated type, transactionID, position in the modified file and a body which contains a dump of the original file part that was modified (Frühwirt et al, 2012(Frühwirt et al, , 2013.…”

“…Recently, new techniques to exploit internal log files for forensic purposes were developed: In (Frühwirt et al, 2012) the authors developed a forensic approach based on data stored in the internal redo logs used for rollbacks and undos. They demonstrated an efficient way to extract simple INSERT, DELETE and UPDATE statements, including eventually deleted information.…”

USING INTERNAL MySQL/InnoDB B-TREE INDEX NAVIGATION FOR DATA HIDING

“…Previous research [2][3][4] has shown that physically-deleted records can be recovered by directly reading the filesystem. Several additional observations can be made based on the index and the actual algorithm that is used:…”

“…Internal mechanisms for guaranteeing database correctness and providing rollback functionality have been used for forensic purposes [4,5].…”