Database forensics: Difference between revisions

Revision as of 11:47, 2 August 2010

Revision as of 11:54, 2 August 2010

Line 1:

{{ForensicScience}}

'''Database Forensics''' is a branch of [[digital forensics|digital forensic science]] relating to the forensic study of [[databases]] and their related metadata.<ref>{{cite web|last=Olivier|first=Martin S.|title=On metadata context in Database Forensics|url=http://www.sciencedirect.com/science/article/B7CW4-4TSD9G6-1/2/a5031117d753054d92f2afba332eadf8|publisher=Science Direct|accessdate=2 August 2010|doi=10.1016/j.diin.2008.10.001.|month=March|year=2009}}</ref>

Definition of Database Forensics: “Gathering and analyzing databases, or specific transactions or tables extracted from databases, in a manner as free from distortion or bias as possible to reconstruct data or events as to what has happened in the past on a system.”

Computer forensics principles can be applied to a database, which is a persistent data store, often relational. This means that sufficient due care by forensic technology professionals is given to how databases are first acquired and then analysed, as not to compromise their integrity. Forensic technology professionals may acquire whole desktops, laptops, servers and mobile devices for forensic examination as part of an ongoing investigation, but database applications may also contain vital evidence. Therefore, when applying computer forensic principles to databases, the database itself must be forensically acquired. This means that forensic copies of database evidence can be made in order to preserve that evidence for future presentation during a legal process.