Visualization and management of digital forensics data

Francia, Guillermo A.; Trifas, Monica; Brown, Dorothy; Francia, Rahjima; Scott, Chrissy

doi:10.1145/1231047.1231068

Cited by 4 publications

(1 citation statement)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Thus, forensic analysis engaging with these locations can reveal recent activities, can help creating a (partial) timeline of past events and recover deleted or modified data [17]. While this fact is well known in computer forensics research and several forensic tools [7] as well as approaches [8], [10], [14], [23] exist to analyze data, the systematic analysis of database systems has only recently begun [11], [12], [15], [22]. Still, to this day, none of these approaches incorporate the data stored in InnoDB's redo logs, which not only constitute a rich vault of information regarding transactions, but even allow the reconstruction of previous states of the database.…”

Section: Introductionmentioning

confidence: 99%

InnoDB Database Forensics: Reconstructing Data Manipulation Queries from Redo Logs

Frühwirt

Kieseberg

Schrittwieser

et al. 2012

2012 Seventh International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Abstract-InnoDB is a powerful open-source storage engine for MySQL that gained much popularity during the recent years. This paper proposes methods for forensic analysis of InnoDB databases by analyzing the redo logs, primarily used for crash recovery within the storage engine. This new method can be very useful in forensic investigations where the attacker got admin privileges, or was the admin himself. While such a powerful attacker could cover tracks by manipulating the log files intended for fraud detection, data cannot be changed easily in the redo logs. Based on a prototype implementation, we show methods for recovering Insert, Delete and Update statements issued against a database.

show abstract