Database image content explorer: Carving data that does not officially exist

详细信息    查看全文

• 作者：James Wagner^a ; ^{jwagne32@mail.depaul.edu" class="auth_mail" title="E-mail the corresponding author} ; Alexander Rasin^a ; ^{arasin@cdm.depaul.edu" class="auth_mail" title="E-mail the corresponding author} ; Jonathan Grier^b ; ^{jdgrier@grierforensics.com" class="auth_mail" title="E-mail the corresponding author}
• 关键词：Database forensics ; File carving ; Data recovery ; Memory analysis ; Stochastic analysis
• 刊名：Digital Investigation
• 出版年：2016
• 出版时间：7 August 2016
• 年：2016
• 卷：18
• 期：supp_S
• 页码：S97-S107
• 全文大小：1306 K

文摘

When a file is deleted, the storage it occupies is de-allocated but the contents of the file are not erased. An extensive selection of file carving tools and techniques is available to forensic analysts – and yet existing file carving techniques cannot recover database storage because all database storage engines use proprietary and unique storage format. Database systems are widely used to store and process data – both on a large scale (e.g., enterprise networks) and for personal use (e.g., SQLite in mobile devices or Firefox). For some databases, users can purchase specialized recovery tools capable of discovering valid rows in storage and yet there are no tools that can recover deleted rows or make analysts aware of the “unseen” database content.

Deletion is just one of the many operations that create de-allocated data in database storage. We use our Database Image Content Explorer tool, based on a universal database storage model, to recover a variety of phantom data: a) data that was actually deleted by a user, b) data that is marked as deleted, but was never explicitly deleted by any user and c) data that is not marked as deleted and had been de-allocated without anyone's knowledge. Data persists in active database tables, in memory, in auxiliary structures or in discarded pages. Strikingly, our tool can even recover data from inserts that were canceled, and thus never officially existed in a data table, which may be of immeasurable value to investigation of financial crimes. In this paper, we describe many recoverable database storage artifacts, investigate survival of data and empirically demonstrate across different databases what our universal, multi-database tool can recover.