View in EDS

Reconstruction in Database Forensics

Saved in:
Bibliographic Details
Title: Reconstruction in Database Forensics
Authors: Fasan, Oluwasola, Mary, Olivier, Martin
Contributors: University of Pretoria South Africa, Gilbert Peterson, Sujeet Shenoi, TC 11, WG 11.9
Source: IFIP Advances in Information and Communication Technology ; 8th International Conference on Digital Forensics (DF) ; https://inria.hal.science/hal-01523705 ; 8th International Conference on Digital Forensics (DF), Jan 2012, Pretoria, South Africa. pp.273-287, ⟨10.1007/978-3-642-33962-2_19⟩
Publisher Information: CCSD
Springer
Publication Year: 2012
Subject Terms: Database forensics, database reconstruction, inverse relational algebra, [INFO]Computer Science [cs]
Subject Geographic: Pretoria, South Africa
Time: Pretoria, South Africa
Description: Part 6: ADVANCED FORENSIC TECHNIQUES ; International audience ; Despite the ubiquity of databases and their importance in digital forensic investigations, the area of database forensics has received very little research attention. This paper presents an algorithm for reconstructing a database for forensic purposes. Given the current instance of a database and the log of modifying queries executed on the database over time, the database reconstruction algorithm determines the data that was present in the database at an earlier time. The algorithm employs inverse relational algebra operators along with a relational algebra log and value blocks of relations to perform database reconstruction. Illustrative examples are provided to demonstrate the application of the algorithm and its utility in forensic investigations.
Document Type: conference object
Language: English
DOI: 10.1007/978-3-642-33962-2_19
Availability: https://inria.hal.science/hal-01523705
https://inria.hal.science/hal-01523705v1/document
https://inria.hal.science/hal-01523705v1/file/978-3-642-33962-2_19_Chapter.pdf
https://doi.org/10.1007/978-3-642-33962-2_19
Rights: http://creativecommons.org/licenses/by/ ; info:eu-repo/semantics/OpenAccess
Accession Number: edsbas.48365590
Database: BASE
Description
Abstract:Part 6: ADVANCED FORENSIC TECHNIQUES ; International audience ; Despite the ubiquity of databases and their importance in digital forensic investigations, the area of database forensics has received very little research attention. This paper presents an algorithm for reconstructing a database for forensic purposes. Given the current instance of a database and the log of modifying queries executed on the database over time, the database reconstruction algorithm determines the data that was present in the database at an earlier time. The algorithm employs inverse relational algebra operators along with a relational algebra log and value blocks of relations to perform database reconstruction. Illustrative examples are provided to demonstrate the application of the algorithm and its utility in forensic investigations.
DOI:10.1007/978-3-642-33962-2_19