TTP: A Kit for Exploring Databases under the Hood for Security, Forensics and Data Recovery

数据库管理系统（DBMS）在组织中用于存储和处理数据已有几十年的历史。较大的组织为不同的部门使用各种数据库（商业的、开源的或定制的）。但是，用户和数据库管理员（dba）都不知道数据存储在哪里或如何处理数据。大多数关系数据库使用可以推断和捕获的通用原则存储内部数据。这个项目构建了一些工具，利用这些原则为许多DBMS的存储提供x射线视图，并准确地说明了内部发生的事情。这项研究对各个层次的用户都有好处：学生、教师、数据库用户、dba和取证分析人员。研究团队开发的工具将允许dba检查存储并观察任何泄漏的数据，并帮助法医分析人员发现在攻击期间数据库中发生了什么。用户将能够恢复已删除的数据，或在面临严重损坏事件时恢复数据。这些工具还可以帮助学生更好地理解入门课程中的数据库操作概念，并帮助他们观察安全漏洞。一些DBMS提供了分析和恢复工具，但是可用的功能总是特定于数据库的，并且在不同的平台上差异很大。这个研究项目标准化了基本的分析和数据恢复能力，并为大多数主要的关系DBMS提供了一个通用的解决方案。该解决方案将包括对可能导致数据丢失或使任何现代DBMS失效的损坏事件的恢复；重建“不可恢复”（即丢弃或删除）的数据；可视化的文物将为法医分析人员提供洞察力。在这个项目中建立的工具将专注于提供易于使用和直观的可视化从磁盘和RAM中解构的所有DBMS内容，并推荐最小化数据泄漏的策略。开发和评估将与IT专业人员、学术dba以及行业合作伙伴合作完成。该项目还将生成一套标准基准，可以量化不同数据库的数据泄漏和恢复率。最后，可视化工具和基准将结合到数据库和安全课程的培训教程和学生课程中。

Database Management Systems (DBMS) have been used to store and process data in organizations for decades. Larger organizations use a variety of databases (commercial, open-source or custom-built) for different departments. However, neither users nor Database Administrators (DBAs) know where the data is stored or how it is processed. Most of the relational databases store internal data using universal principles that can be inferred and captured. This project builds tools that draw on these principles to offer x-ray vision into storage of many DBMS, illustrating exactly what is happening inside. This research benefits users at all levels: students, teachers, database users, DBAs and forensic analysts. Tools developed by the research team will let DBAs inspect storage and observe any leaking data and help forensic analysts discover what happened in a database during an attack. Users will be able to restore data that was deleted or recover in the face of a critical corruption event. The same tools also help students to better understand concepts of database operations in introductory courses and help them observe security vulnerabilities.Some DBMS' provide profiling and recovery tools, but the available functionality is always database-specific and varies wildly across different platforms. This research project standardizes basic profiling and data recovery capabilities and deliver a universal solution for most major relational DBMS. This solution will include recovery against corruption events that can cause data loss or incapacitate any modern DBMS; reconstruction of "unrecoverable" (i.e., discarded or deleted) data; and visualizing artifacts that will offer insight to forensic analysts. The tools built in this project will focus on providing easy-to-use and intuitive visualization of all deconstructed DBMS content from disk and RAM and recommend strategies for minimizing data leaks. Development and evaluation will be done in collaboration with IT professionals and academic DBAs as well as industry partners. This project will also produce a suite of standard benchmarks that can quantify data leakage and recovery rates for different databases. Finally, the visualization tools and benchmarks will be combined into training tutorials and student lessons both for database and security curricula.