Five Stages of Database Forensic Analysis: A Systematic Literature Review

Bria, Robertus; Retnowardhani, Astari; Utama, Ditdit Nugeraha

doi:10.1109/icimtech.2018.8528177

Cited by 15 publications

(14 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Recently, four investigation processes have been proposed by [26] identification, artifact collection, artifact analysis, and presentation and documentation. Bria [27] proposed five investigation processes, which are database identification, investigation, artefacts collection, analysis, and documentation. These processes have been widely explored in other domains of digital forensics, and have been proven to indeed demonstrate some tendency of overlap [2,3].…”

Section: Background and Related Workmentioning

confidence: 99%

“…Also, the Identification process proposed by [26] is used to prepare a clean database forensic investigation environment and trusted forensic techniques, as well as allow the investigation team to isolate the database server from the network to prevent users from tampering with it, and to capture volatile and non-volatile data. Finally, [27] introduced a Database Identification process useful for defining, identifying, preparing, detecting, and investigating database incidents. This is the initial process of an investigation to find a problem in the database.…”

Section: Phase Iii: Categorization Of the Extracted Database Forensicmentioning

confidence: 99%

See 1 more Smart Citation

Categorization and Organization of Database Forensic Investigation Processes

et al. 2020

View full text Add to dashboard Cite

Database forensic investigation (DBFI) is an important area of research within digital forensics. It's importance is growing as digital data becomes more extensive and commonplace. The challenges associated with DBFI are numerous, and one of the challenges is the lack of a harmonized DBFI process for investigators to follow. In this paper, therefore, we conduct a survey of existing literature with the hope of understanding the body of work already accomplished. Furthermore, we build on the existing literature to present a harmonized DBFI process using design science research methodology. This harmonized DBFI process has been developed based on three key categories (i.e. planning, preparation and pre-response, acquisition and preservation, and analysis and reconstruction). Furthermore, the DBFI has been designed to avoid confusion or ambiguity, as well as providing practitioners with a systematic method of performing DBFI with a higher degree of certainty. INDEX TERMS Database forensics, database forensic investigation, digital forensics, investigation process model.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

Section: Phase Iii: Categorization Of the Extracted Database Forensicmentioning

confidence: 99%

Categorization and Organization of Database Forensic Investigation Processes

et al. 2020

View full text Add to dashboard Cite

show abstract

“…Also, the Identification process proposed by [43] is used to prepare a clean database forensic investigation environment and trusted forensic techniques, as well as allow the investigation team to isolate the database server from the network to prevent users from tampering with it and to capture volatile and non-volatile data. Finally, [44] introduced a Database Identification process useful for defining, identifying, preparing, detecting, and investigating database incidents. This is the initial process of an investigation to find a problem in the database.…”

Section: Phase 3: Combined Similar Processesmentioning

confidence: 99%

“…2018 CDBFIP: Common database forensic investigation processes for internet of things[43].22. 2018 Five Stages of Database Forensic Analysis: A SystematicLiterature Review[44]…”

mentioning

confidence: 99%

Towards the Development of an Integrated Incident Response Model for Database Forensic Investigation Field

et al. 2020

View full text Add to dashboard Cite

For every contact that is made in a database, a digital trace will potentially be left and most of the database breaches are mostly aimed at defeating the major security goals (Confidentiality, Integrity, and Authenticity) of data that reside in the database. In order to prove/refute a fact during litigation, it is important to identify suitable investigation techniques that can be used to link a potential incident/suspect to the digital crime. As a result, this paper has proposed suitable steps of constructing and Integrated Incident Response Model (IIRM) that can be relied upon in the database forensic investigation field. While developing the IIRM, design science methodology has been adapted and the outcome of this study has shown significant and promising approaches that could be leveraged by digital forensic experts, legal practitioners and law enforcement agencies. This is owing to the fact, that IIRM construction has followed incident investigation principles that are stipulated in ISO guidelines. INDEX TERMS Database security, database forensics investigation, database incident, pre-incident response, during-incident response, post-incident response.

show abstract

“…The methods approach raw data directly, so it can improve the drawback of the log-based method. Previous studies mainly analyzed small-sized databases such as SQLite [15]- [17] and EDB [18], [19], used in endpoint devices (desktop computers, smartphones, and tablets). On the other hand, there is no research describing an engine-based recovery method for large databases, mainly used in enterprises or large organizations, such as MSSQL and Oracle.…”

Section: Introductionmentioning

confidence: 99%

Forensic Recovery of SQL Server Database: Practical Approach

2021

View full text Add to dashboard Cite

Database forensics is becoming more important for investigators with the increased use of the information system. Although various database forensic methods such as log analysis and investigation model development have been studied, among the database forensic methods, recovering deleted data is a key technique in database investigation for DB tampering and anti-forensics. Previous studies mainly focused on transaction or journal log to recover deleted data, but if logs are set to be deleted periodically or logs containing critical evidence are overwritten by new logs, the log-based recovery method can not be used practically. For this reason, an engine-based recovery method that analyzes data file at a raw level has been also introduced. There is research to recover small-sized databases such as SQLite and EDB, but there is no prior work describing the structure of data file and technology to recover deleted data of large databases used by enterprises or large organizations. In this context, we investigate Microsoft SQL Server (MSSQL), which is one of the most used large databases. Our method focuses on a storage engine of MSSQL. Through analyzing the storage engine, we identify the internal structure of MSSQL data files and the storage mechanism. Based on these findings, a method to recover tables and records is presented by empirical examination. It is compatible with various versions of MSSQL because it accesses data at the raw level. Our proposed method is verified by a comparative experiment with forensic tools implemented to recover deleted MSSQL data. The experimental results show that our method recovers all deleted records from the unallocated area. It recovers all data types including multimedia data, called Large Objects (LOB) in the database field. To contribute digital forensic community, we also provide the source code of the implementation; it facilitates the knowledge sharing of database forensics.

show abstract

Five Stages of Database Forensic Analysis: A Systematic Literature Review

Cited by 15 publications

References 14 publications

Categorization and Organization of Database Forensic Investigation Processes

Categorization and Organization of Database Forensic Investigation Processes

Towards the Development of an Integrated Incident Response Model for Database Forensic Investigation Field

Forensic Recovery of SQL Server Database: Practical Approach

Contact Info

Product

Resources

About