Database forensics

Forensic science

Physiological sciences
Forensic anthropology Forensic dentistry Forensic entomology Forensic pathology Forensic botany Forensic biology DNA profiling DNA phenotyping Bloodstain pattern analysis Forensic chemistry
Social sciences
Forensic psychology Forensic psychiatry
Forensic criminalistics
Body identification Fingerprint analysis Forensic accounting Forensic arts Forensic firearm examination Forensic footwear evidence Forensic toxicology Gloveprint analysis Palmprint analysis Questioned document examination Vein matching
Digital forensics
Computer forensics Forensic data analysis Database forensics Mobile device forensics Network forensics Forensic video Forensic audio
Related disciplines
Fire investigation Fire accelerant detection Forensic engineering Forensic linguistics Forensic materials engineering Forensic polymer engineering Forensic statistics Vehicular accident reconstruction
Related articles
Crime scene CSI effect Perry Mason syndrome Pollen calendar Skid mark Trace evidence Use of DNA in forensic entomology

Database forensics is a branch of digital forensic science relating to the forensic study of databases and their related metadata.^[1]

The discipline is similar to computer forensics, following the normal forensic process and applying investigative techniques to database contents and metadata. Cached information may also exist in a servers RAM requiring live analysis techniques.

A forensic examination of a database may relate to the timestamps that apply to the update time of a row in a relational table being inspected and tested for validity in order to verify the actions of a database user. Alternatively, a forensic examination may focus on identifying transactions within a database system or application that indicate evidence of wrongdoing, such as fraud.

Software tools can be used to manipulate and analyse data. These tools also provide audit logging capabilities which provide documented proof of what tasks or analysis a forensic examiner performed on the database.

Currently many database software tools are in general not reliable and precise enough to be used for forensic work as demonstrated in the first paper published on database forensics.^[2] There is currently a single book published in this field,^[3] though more are destined.^[4] Additionally there is a subsequent SQL Server forensics book by Kevvie Fowler named SQL Server Forensics which is well regarded also.^[5]

The forensic study of relational databases requires a knowledge of the standard used to encode data on the computer disk. A documentation of standards used to encode information in well-known brands of DB such as SQL Server and Oracle has been contributed to the public domain.^[6]^[7] Others include Apex Analytix.^[8]

Because the forensic analysis of a database is not executed in isolation, the technological framework within which a subject database exists is crucial to understanding and resolving questions of data authenticity and integrity especially as it relates to database users.

References

↑ Olivier, Martin S. (March 2009). "On metadata context in Database Forensics". Science Direct. doi:10.1016/j.diin.2008.10.001. Retrieved 2 August 2010.
↑ Oracle Database Forensics using LogMiner - GIAC Certified Student Practical
↑ Oracle Forensics ISBN 0-9776715-2-6 (May 2008)
↑ Oracle Forensics Using Quisix ISBN 0-470-19118-X (Dec 2008)
↑ SQL Server Forensics ISBN 0-321-54436-6 (Dec 2008)
↑ SANS Institute - Forensic Analysis of a SQL Server 2005 Database Server
↑ Oracle Forensics and Incident Response - databasesecurity.com
↑ http://www.bizjournals.com/triad/stories/2004/01/05/story3.html

Digital forensics

Branches	Computer forensics Mobile device forensics Network forensics Database forensics

Hardware	Forensic disk controller

Software	EnCase Foremost FTK Registry Recon PTK Forensics The Sleuth Kit The Coroner's Toolkit COFEE Selective file dumper HashKeeper Xplico

Certification	Certified Forensic Computer Examiner (CFCE) Global Information Assurance Certification

Processes	Digital forensic process Data acquisition Digital evidence eDiscovery Anti-computer forensics

Organisations	National Software Reference Library American Society of Digital Forensics & eDiscovery Department of Defense Cyber Crime Center National Hi-Tech Crime Unit (NHTCU) Australian High Tech Crime Centre (AHTCC)

People	Eoghan Casey Clifford Stoll Erik Laykin Robert Zeidman

Glossary of digital forensics terms

Database

Main	Requirements Theory Models Database management system Machine Server Application Connection datasource DSN Administrator Lock Types Tools

Languages	Data definition Data manipulation Query information retrieval

Security	Activity monitoring Audit Forensics Negative database

Design	Entities and relationships (and Enhanced notation) Normalization Refactoring

Programming	Abstraction layer Object-relational mapping

Management	Virtualization Tuning caching Migration Preservation Integrity

See also	Database-centric architecture Intelligent database Two-phase locking Locks with ordered sharing Load file Publishing Halloween Problem Log shipping

Book Category WikiProject

This article is issued from Wikipedia - version of the 11/24/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.

Database forensics

Further reading

References