Forensic Recovery of SQL Server Database: Practical Approach
Database forensics is becoming more important for investigators with the increased use of the information system. Although various database forensic methods such as log analysis and investigation model development have been studied, among the database forensic methods, recovering deleted data is a k...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2021-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9328241/ |
| _version_ | 1818857034603298816 |
|---|---|
| author | Hoyong Choi Sangjin Lee Doowon Jeong |
| author_facet | Hoyong Choi Sangjin Lee Doowon Jeong |
| author_sort | Hoyong Choi |
| collection | DOAJ |
| description | Database forensics is becoming more important for investigators with the increased use of the information system. Although various database forensic methods such as log analysis and investigation model development have been studied, among the database forensic methods, recovering deleted data is a key technique in database investigation for DB tampering and anti-forensics. Previous studies mainly focused on transaction or journal log to recover deleted data, but if logs are set to be deleted periodically or logs containing critical evidence are overwritten by new logs, the log-based recovery method can not be used practically. For this reason, an engine-based recovery method that analyzes data file at a raw level has been also introduced. There is research to recover small-sized databases such as SQLite and EDB, but there is no prior work describing the structure of data file and technology to recover deleted data of large databases used by enterprises or large organizations. In this context, we investigate Microsoft SQL Server (MSSQL), which is one of the most used large databases. Our method focuses on a storage engine of MSSQL. Through analyzing the storage engine, we identify the internal structure of MSSQL data files and the storage mechanism. Based on these findings, a method to recover tables and records is presented by empirical examination. It is compatible with various versions of MSSQL because it accesses data at the raw level. Our proposed method is verified by a comparative experiment with forensic tools implemented to recover deleted MSSQL data. The experimental results show that our method recovers all deleted records from the unallocated area. It recovers all data types including multimedia data, called Large Objects (LOB) in the database field. To contribute digital forensic community, we also provide the source code of the implementation; it facilitates the knowledge sharing of database forensics. |
| first_indexed | 2024-12-19T08:33:59Z |
| format | Article |
| id | doaj.art-8edac5c02a0740628b7eb909d1b7aed0 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-19T08:33:59Z |
| publishDate | 2021-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-8edac5c02a0740628b7eb909d1b7aed02022-12-21T20:29:06ZengIEEEIEEE Access2169-35362021-01-019145641457510.1109/ACCESS.2021.30525059328241Forensic Recovery of SQL Server Database: Practical ApproachHoyong Choi0https://orcid.org/0000-0001-9792-7133Sangjin Lee1https://orcid.org/0000-0002-6809-5179Doowon Jeong2https://orcid.org/0000-0001-7593-9416Institute of Cyber Security and Privacy (ICSP), Korea University, Seoul, South KoreaInstitute of Cyber Security and Privacy (ICSP), Korea University, Seoul, South KoreaCollege of Police and Criminal Justice, Dongguk University, Seoul, South KoreaDatabase forensics is becoming more important for investigators with the increased use of the information system. Although various database forensic methods such as log analysis and investigation model development have been studied, among the database forensic methods, recovering deleted data is a key technique in database investigation for DB tampering and anti-forensics. Previous studies mainly focused on transaction or journal log to recover deleted data, but if logs are set to be deleted periodically or logs containing critical evidence are overwritten by new logs, the log-based recovery method can not be used practically. For this reason, an engine-based recovery method that analyzes data file at a raw level has been also introduced. There is research to recover small-sized databases such as SQLite and EDB, but there is no prior work describing the structure of data file and technology to recover deleted data of large databases used by enterprises or large organizations. In this context, we investigate Microsoft SQL Server (MSSQL), which is one of the most used large databases. Our method focuses on a storage engine of MSSQL. Through analyzing the storage engine, we identify the internal structure of MSSQL data files and the storage mechanism. Based on these findings, a method to recover tables and records is presented by empirical examination. It is compatible with various versions of MSSQL because it accesses data at the raw level. Our proposed method is verified by a comparative experiment with forensic tools implemented to recover deleted MSSQL data. The experimental results show that our method recovers all deleted records from the unallocated area. It recovers all data types including multimedia data, called Large Objects (LOB) in the database field. To contribute digital forensic community, we also provide the source code of the implementation; it facilitates the knowledge sharing of database forensics.https://ieeexplore.ieee.org/document/9328241/DatabaseforensicsSQL serverMSSQLservers |
| spellingShingle | Hoyong Choi Sangjin Lee Doowon Jeong Forensic Recovery of SQL Server Database: Practical Approach IEEE Access Database forensics SQL server MSSQL servers |
| title | Forensic Recovery of SQL Server Database: Practical Approach |
| title_full | Forensic Recovery of SQL Server Database: Practical Approach |
| title_fullStr | Forensic Recovery of SQL Server Database: Practical Approach |
| title_full_unstemmed | Forensic Recovery of SQL Server Database: Practical Approach |
| title_short | Forensic Recovery of SQL Server Database: Practical Approach |
| title_sort | forensic recovery of sql server database practical approach |
| topic | Database forensics SQL server MSSQL servers |
| url | https://ieeexplore.ieee.org/document/9328241/ |
| work_keys_str_mv | AT hoyongchoi forensicrecoveryofsqlserverdatabasepracticalapproach AT sangjinlee forensicrecoveryofsqlserverdatabasepracticalapproach AT doowonjeong forensicrecoveryofsqlserverdatabasepracticalapproach |