Tamper Detection in Cassandra and Redis Database—A Comparative Study

Golhar, Archana; Janvir, Sakshi; Chopade, Rupali M.; Pachghare, Vinod

doi:10.1007/978-981-15-0790-8_11

Cited by 2 publications

(3 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…They presented how to investigate the tampering in NoSQL data files. Golhar et al [11] also proposed the method to detect NoSQL tampering. They explored log files of Redis and Cassandra to identify problems of databases such as data consistency, data integrity, and availability.…”

Section: ) Nosqlmentioning

confidence: 99%

“…forensic methods, recovering deleted records plays an important role in finding the evidence, because it can recover data that existed in the past or that was intentionally deleted for anti-forensics [10]. Especially, attackers try to the database tampering to take away sensitive information or try to delete the information [11]; by recovering deleted records, an investigator can detect and deal with these behaviors [12]. The recovery of deleted records is also used to solve the financial fraud cases in forensic accounting [13].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Forensic Recovery of SQL Server Database: Practical Approach

2021

View full text Add to dashboard Cite

Database forensics is becoming more important for investigators with the increased use of the information system. Although various database forensic methods such as log analysis and investigation model development have been studied, among the database forensic methods, recovering deleted data is a key technique in database investigation for DB tampering and anti-forensics. Previous studies mainly focused on transaction or journal log to recover deleted data, but if logs are set to be deleted periodically or logs containing critical evidence are overwritten by new logs, the log-based recovery method can not be used practically. For this reason, an engine-based recovery method that analyzes data file at a raw level has been also introduced. There is research to recover small-sized databases such as SQLite and EDB, but there is no prior work describing the structure of data file and technology to recover deleted data of large databases used by enterprises or large organizations. In this context, we investigate Microsoft SQL Server (MSSQL), which is one of the most used large databases. Our method focuses on a storage engine of MSSQL. Through analyzing the storage engine, we identify the internal structure of MSSQL data files and the storage mechanism. Based on these findings, a method to recover tables and records is presented by empirical examination. It is compatible with various versions of MSSQL because it accesses data at the raw level. Our proposed method is verified by a comparative experiment with forensic tools implemented to recover deleted MSSQL data. The experimental results show that our method recovers all deleted records from the unallocated area. It recovers all data types including multimedia data, called Large Objects (LOB) in the database field. To contribute digital forensic community, we also provide the source code of the implementation; it facilitates the knowledge sharing of database forensics.

show abstract

Section: ) Nosqlmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Forensic Recovery of SQL Server Database: Practical Approach

2021

View full text Add to dashboard Cite

show abstract

“…The hashing is a most commonly used technique for tamper detection [10]. Hashing is useful to identify the tampering in database [11,12], but it won't help to identify, what has tampered? and that's the major limitation.…”

Section: Introductionmentioning

confidence: 99%

Data Tamper Detection from NoSQL Database in Forensic Environment

Chopade

Pachghare

2021

JCSANDM

View full text Add to dashboard Cite

The growth of service sector is increasing the usage of digital applications worldwide. These digital applications are making use of database to store the sensitive and secret information. As the database has distributed over the internet, cybercrime attackers may tamper the database to attack on such sensitive and confidential information. In such scenario, maintaining the integrity of database is a big challenge. Database tampering will change the database state by any data manipulation operation like insert, update or delete. Tamper detection techniques are useful for the detection of such data tampering which play an important role in database forensic investigation process. Use of NoSQL database has been attracted by big data requirements. Previous research work has limited to tamper detection in relational database and very less work has been found in NoSQL database. So there is a need to propose a mechanism to detect the tampering of NoSQL database systems. Whereas this article proposes an idea of tamper detection in NoSQL database such as MongoDB and Cassandra, which are widely used document-oriented and column-based NoSQL database respectively. This research work has proposed tamper detection technique which works in forensic environment to give more relevant outcome on data tampering and distinguish between suspicious and genuine tampering.

show abstract

Tamper Detection in Cassandra and Redis Database—A Comparative Study

Cited by 2 publications

References 5 publications

Forensic Recovery of SQL Server Database: Practical Approach

Forensic Recovery of SQL Server Database: Practical Approach

Data Tamper Detection from NoSQL Database in Forensic Environment

Contact Info

Product

Resources

About