Towards a forensic-aware database solution: Using a secured database replication protocol and transaction management for digital investigations

A tamper-proof audit and control system for the doctor in the loop

“…The term “chained witnesses” was coined in [18], where the authors propose a technique for securing internal mechanisms of databases against manipulation. The main advantage of this approach over the multitude of approaches described in the literature was resilience against an attacker model that included the database administrator as possible adversary.…”

“…For the verification, the data of the protected internal logging mechanisms are executed against an old trusted backup under the premise of and compared to the investigated database instance. This also works, when reverting the whole database to an old state: The PRNG is seeded with a seed unknown to the attacker, every iteration changes the state of the PRNG, which cannot be calculated backwards (this is ensured by the criteria for the hash function and the PRNG in [18]). Thus, in the case of reverting, the states of the missing entries can be detected easily.…”

“…Thus, in the case of reverting, the states of the missing entries can be detected easily. In [18], the authors propose several mechanisms for achieving this kind of manipulation security in real-life environments, especially targeting internal database mechanisms for providing rollbacks (so-called   transaction logs 2). The transaction log is stored directly by the database environment as an internal component.…”

“…The transaction log is stored directly by the database environment as an internal component. Figure 1 also demonstrates, how the log entry is extended in order to store the witness, more details on the exact specification of the log entries can be found in [18]. Furthermore, the database management system (DBMS) must be modified in a way to provide the calculation of the respective witness as an atomic action, invisible to and uninterruptable by the administrator, i.e., the mechanism for writing the transaction log needs to be modified directly in the DBMS-code in order to fetch the random numbers and calculate the witness immediately, without leaking to the administrator.…”

USING INTERNAL MySQL/InnoDB B-TREE INDEX NAVIGATION FOR DATA HIDING

“…Previous research [2][3][4] has shown that physically-deleted records can be recovered by directly reading the filesystem. Several additional observations can be made based on the index and the actual algorithm that is used:…”