TTP: Small: A Kit for Exploring Databases under the Hood for Security, Forensics and Data Recovery

数据库管理系统（DBMS）已经被用于存储和处理组织中的数据几十年了。较大的组织为不同的部门使用各种数据库（商业，开源或定制）。但是，用户和数据库管理员（DBA）都不知道数据在系统上存储的确切位置以及如何处理数据。大多数关系数据库使用可以推断和捕获的通用原则存储内部数据。该项目将构建利用这些原则的工具，为许多DBMS的存储提供X射线视觉，并准确说明内部发生的事情。这项研究使来自各种背景的用户受益：学生，教师，数据库用户，DBA和法医分析师。研究团队开发的工具使DBA能够检查存储并观察任何泄漏数据，从而帮助取证分析师发现攻击期间数据库中发生的情况。用户可以恢复在严重损坏事件中删除的数据并恢复它。相同的工具可以帮助学生在入门课程中使用它们来了解数据库操作的概念，在此期间学生观察安全漏洞。一些DBMS提供了分析和恢复工具，但功能总是特定于数据库的，并且在不同的平台上变化很大。这个研究项目提供了基本的分析和数据恢复能力，并为大多数主要的关系数据库管理系统提供了一个通用的解决方案。该解决方案包括针对可能导致数据丢失或使任何现代DBMS丧失能力的损坏事件的恢复;“不可恢复”（即，丢弃或删除）的数据;以及可视化为取证分析师提供洞察力的工件。该项目中构建的工具专注于为磁盘和RAM中所有解构的DBMS内容提供易于使用和直观的可视化，并推荐最小化数据泄漏的策略。开发和评估是与信息技术（IT）专业人员和学术DBA以及行业合作伙伴合作完成的。该项目还生成了一套标准基准，可以量化不同数据库的数据泄漏和恢复率。最后，将可视化工具和基准测试结合到数据库和安全知识库的培训教程和学生课程中。

Database Management Systems (DBMS) have been used to store and process data in organizations for decades. Larger organizations use a variety of databases (commercial, open-source or custom-built) for different departments. However, neither users nor Database Administrators (DBAs) know exactly where the data is stored on the system or how it is processed. Most relational databases store internal data using universal principles that can be inferred and captured. This project will build tools that draw on these principles to offer x-ray vision into storage of many DBMS, illustrating exactly what is happening inside. This research benefits users from a variety of backgrounds: students, teachers, database users, DBAs and forensic analysts. Tools developed by the research team enable DBAs to inspect storage and observe any leaking data, thereby helping forensic analysts discover what happened in a database during an attack. Users are given the power to restore data that was deleted in the face of a critical corruption event and recover it. The same tools help students understand concepts of database operations by their use in introductory courses during which students observe security vulnerabilities. Some DBMS's provide profiling and recovery tools, but the functionality is always database-specific and varies wildly across different platforms. This research project standardizes basic profiling and data recovery capabilities and delivers a universal solution for most major relational DBMS. This solution includes recovery against corruption events that can cause data loss or incapacitate any modern DBMS; reconstruction of "unrecoverable" (i.e., discarded or deleted) data; and visualizing artifacts that offer insight to forensic analysts. The tools built in this project focus on providing easy-to-use and intuitive visualization of all deconstructed DBMS content from disk and RAM and recommend strategies for minimizing data leaks. Development and evaluation is done in collaboration with Information Technology (IT) professionals and academic DBAs as well as industry partners. This project also produces a suite of standard benchmarks that can quantify data leakage and recovery rates for different databases. Finally, the visualization tools and benchmarks are combined into training tutorials and student lessons both for database and security curriculums.