Database forensics: Difference between revisions

Revision as of 02:15, 10 January 2017

Revision as of 08:25, 3 March 2017

Line 1:

{{refimprove|date=August 2010}}

{{ForensicScience|digital|image=Hard disk.jpg}}

'''Database forensics''' is a branch of [[digital forensics|digital forensic science]] relating to the forensic study of [[databases]] and their related metadata.<ref>{{cite webjournal|last=Olivier|first=Martin S.|title=On metadata context in Database Forensics|url=http://www.sciencedirect.com/science/article/B7CW4-4TSD9G6-1/2/a5031117d753054d92f2afba332eadf8|publisher=Science Direct|accessdate=2 August 2010|doi=10.1016/j.diin.2008.10.001|date=March 2009|volume=5|journal=Digital Investigation|pages=115–123}}</ref>

The discipline is similar to [[computer forensics]], following the normal forensic process and applying investigative techniques to database contents and metadata. Cached information may also exist in a servers [[RAM]] requiring [[Digital forensics#live analysis|live analysis]] techniques.