InnoDB Database Forensics

Whenever data is being processed, there are many places where parts of the data are temporarily stored; thus forensic analysis can reveal past activities, create a (partial) timeline and recover deleted data. While this fact is well known for computer forensics, multiple forensic tools exist to anal...

Full description

Saved in:
Bibliographic Details
Main Authors: Frühwirt, Peter, Huber, Marcus, Mulazzani, Martin, Weippl, Edgar R
Format: Conference Proceeding
Language:English
Subjects:
Data analysis
Data structures
Database and Forensic
Database systems
Documentation
Engines
File systems
Forensics
Indexes
Information analysis
InnoDB
MySQL
Protection
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Whenever data is being processed, there are many places where parts of the data are temporarily stored; thus forensic analysis can reveal past activities, create a (partial) timeline and recover deleted data. While this fact is well known for computer forensics, multiple forensic tools exist to analyze data and the systematic analysis of database systems has only recently begun. This paper will describe the file format of the MySQL Database 5.1.32 with InnoDB Storage Engine. It will further explain with a practical example of how to reconstruct the data found in the file system of any SQL table. We will show how to reconstruct the table as it is, read data sets from the file and how to interpret the gained information.
ISSN:1550-445X
2332-5658
DOI:10.1109/AINA.2010.152