On the Completeness of Reconstructed Data for Database Forensics
On the Completeness of Reconstructed Data for Database Forensics
复制标题
论数据库取证重构数据的完整性
DOI：
10.1007/978-3-642-39891-9_14
复制
发表时间：
2012
期刊：
影响因子：
--
通讯作者：
M. Olivier
中科院分区：
文献类型：
--
作者：
O. M. Adedayo;M. Olivier
数据库通常用于存储各种组织中的关键和敏感信息，这导致数据库在计算机犯罪中被利用的比率增加。尽管已经探索了涉及数据库的各种调查，但对数据库取证的研究很少。本文简要介绍了一种数据库重建算法在早期的工作，并显示的限制，可以遇到的算法时，必须处理部分重建的关系或删除元组的关系。由于重建的数据通常可以用作支持或反驳数据库中数据的证据，因此无法重建必要的数据可能意味着缺乏证据。然而，根据法医学的一条公理，这并不意味着没有证据。因此，本文提出了两种不同的技术，可用于重建关系中的更多元组，并为数据库中数据的声明提供佐证。通过一个典型的实例，说明了数据库重构算法的局限性，以及如何利用本文所述的技术克服这些局限性。
Databases are often used to store critical and sensitive information in various organizations and this has led to an increase in the rate at which databases are exploited in computer crimes. Even though various investigations involving databases have been explored, very little amount of research has been done on database forensics. This paper briefly describes a database reconstruction algorithm presented in an earlier work and shows the limitation that can be encountered when the algorithm has to deal with partially reconstructed relations or the deletion of tuples in a relation. Since reconstructed data can often be used as the evidence to support or refute claims about the data in a database, the inability to reconstruct necessary data may imply the absence of evidence. However, according to an axiom from forensic science, this does not mean an evidence of absence. As such, this paper presents two different techniques that can be used in reconstructing more tuples in a relation and provide corroborating evidence to claims about the data on a database. A typical example is used to describe the limitation of the database reconstruction algorithm and how the limitation can be overcomed by using the techniques described in the paper.