Ideal log setting for database forensics reconstruction

被引：22

作者：

Adedayo, Oluwasola Mary ^{[1
]}

Olivier, Martin S. ^{[1
]}

机构：

[1] Univ Pretoria, ICSA Res Grp, Comp Sci, ZA-0002 Pretoria, South Africa

来源：

DIGITAL INVESTIGATION | 2015年 / 12卷

关键词：

Database management system; Database forensics; Digital forensics; Reconstruction; Ideal log setting;

D O I：

10.1016/j.diin.2014.12.002

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

The ability to reconstruct the data stored in a database at an earlier time is an important aspect of database forensics. Past research shows that the log file in a database can be useful for reconstruction. However, in many database systems there are various options that control which information is included in the logs. This paper introduces the notion of the ideal log setting necessary for an effective reconstruction process in database forensics. The paper provides a survey of the default logging preferences in some of the popular database management systems and identifies the information that a database log should contain in order to be useful for reconstruction. The challenges that may be encountered in storing the information as well as ways of overcoming the challenges are discussed. Possible logging preferences that may be considered as the ideal log setting for the popular database systems are also proposed. In addition, the paper relates the identified requirements to the three dimensions of reconstruction in database forensics and points out the additional requirements and/or techniques that may be required in the different dimensions. (C) 2014 Elsevier Ltd. All rights reserved.

引用

页码：27 / 40

页数：14

共 47 条

[11]

Bevel T., 2002, BLOODSTAIN PATTERN A, V2nd

[12]

Beyers H., 2011, Advances in Digital Forensics VII, V361, P89, DOI DOI 10.1007/978-3-642-24212-07

[13]

BRIAN C, 2005, FILE SYSTEM FORENSIC

[14]

Carrier B., 2003, INT J DIGITAL EVIDEN, V2, P1

[15]

Carrier Brian D, 2006, THESIS PURDUE U INDI

[16]

Carrier Brian D, 2006, COMMUN ACM, P49

[17]

Eoghan Casey, 2011, COMPUTERS INTERNET

[18]

Fang R, 2011, PROC INT CONF DATA, P1221, DOI 10.1109/ICDE.2011.5767918

[19]

Fasan O.M., 2012, Proceedings of the Seventh International Workshop on Digital Forensics Incident Analysis (WDFIA), P97

[20]

Fasan OM, 2012, IFIP ADV INF COMM TE, V383, P273

← 1 2 3 4 5 →