Database forensics: Difference between revisions

Revision as of 01:50, 6 June 2017

Revision as of 21:44, 16 February 2019

Line 1:

{{refimprove|date=August 2010}}

{{ForensicScience|digital|image=Hard disk.jpg}}

'''Database forensics''' is a branch of [[digital forensics|digital forensic science]] relating to the forensic study of [[databases]] and their related metadata.<ref>{{cite journal|last=Olivier|first=Martin S.|title=On metadata context in Database Forensics|url=http://www.sciencedirect.com/science/article/B7CW4-4TSD9G6-1/2/a5031117d753054d92f2afba332eadf8|publisher=Science Direct|accessdate=2 August 2010|doi=10.1016/j.diin.2008.10.001|date=March 2009|volume=5|issue=3–4|journal=Digital Investigation|pages=115–123|citeseerx=10.1.1.566.7390}}</ref>

The discipline is similar to [[computer forensics]], following the normal forensic process and applying investigative techniques to database contents and metadata. Cached information may also exist in a servers [[RAM]] requiring [[Digital forensics#live analysis|live analysis]] techniques.