Reconstruction in Database Forensics

Fasan and Olivier

2012

Citation information

O. M. Fasan and M. S. Olivier. “Reconstruction in Database Forensics”. In: Advances in Digital Forensics VIII. Ed. by G. Peterson and S. Shenoi. Springer, 2012, pp. 273–287

Abstract

Despite the ubiquity of databases and their importance in digital forensic investigations, the area of database forensics has received very little research attention. This paper presents an algorithm for reconstructing a database for forensic purposes. Given the current instance of a database and the log of modifying queries executed on the database over time, the database reconstruction algorithm determines the data that was present in the database at an earlier time. The algorithm employs inverse relational algebra operators along with a relational algebra log and value blocks of relations to perform database reconstruction. Illustrative examples are provided to demonstrate the application of the algorithm and its utility in forensic investigations.

Full text

A pre- or postprint of the publication is available at https://mo.co.za/open/dbrecon.pdf.

Deﬁnitive version

The deﬁnitive version of the paper is available from the publisher.
DOI: 10.1007/978-3-642-33962-2_19

BibTeX reference

@inproceedings(dbrecon,
author={Olusawa Mary Fasan and Martin S Olivier},
title={Reconstruction in Database Forensics},
booktitle={Advances in Digital Forensics VIII},
Editor={Gilbert Peterson and Sujeet Shenoi},
year={2012},
pages={273--287},
publisher={Springer} )