Module: 11
Database Forensics
LEARNING OBJECTIVES
The learning objectives of this module are to:
✓ LO#01: Understand Database Forensics and its Importance ✓
LO#02: Determine Data Storage and Database Evidence Repositories in MSSQL Server ✓
LO#03: Collect Evidence Files on MSSQL Server ✓
LO#04: Perform MSSQL Forensics ✓
LO#05: Understand Internal Architecture of MySQL and Structure of Data Directory ✓
LO#06: Understand Information Schema and List MySQL Utilities for Performing Forensic Analysis ✓
LO#07: Perform MySQL Forensics on WordPress Web Application Database
Understand Database
Forensics and
its Importance
Understand Database Forensics and its Importance
Database Forensics and its Importance
Determine Data Storage and Database Evidence Repositories in MSSQL Server
Determine Data Storage and Database Evidence Repositories in MSSQL Server
Data Storage in SQL Server
Database Evidence Repositories
Collect Evidence Files on MSSQL Server
Collect Evidence Files on MSSQL Server
Collecting Volatile Database Data
Collecting Primary Data File and Active Transaction Logs Using SQLCMD
Collecting Primary Data File and Active Transaction Logs Using SQLCMD (Cont’d)
Collecting Primary Data File and Active Transaction Logs Using SQLCMD (Cont’d)
Collecting Primary Data File and Active Transaction Logs Using SQLCMD (Cont’d)
Collecting Primary Data File and Active Transaction Logs Using SQLCMD (Cont’d)
Collecting Primary Data File and Active Transaction Logs Using SQLCMD (Cont’d)
Collecting Primary Data File and Transaction Logs
Collecting Active Transaction Logs Using SQL Server Management Studio
Collecting Active Transaction Logs Using SQL Server Management Studio (Cont’d)
Collecting Active Transaction Logs Using SQL Server Management Studio (Cont’d)
Collecting Active Transaction Logs Using SQL Server Management Studio (Cont’d)
Collecting Database Plan Cache
Collecting Database Plan Cache
Collecting Database Plan Cache (Cont’d)
Collecting Database Plan Cache (Cont’d)
Collecting SQL Server Trace Files
Collecting SQL Server Error Logs
Perform MSSQL Forensics
Perform
MSSQL Forensics
Database Forensics Using SQL Server Management Studio
Title
Database Forensics Using SQL Server Management Studio (Cont’d)
Title
Database Forensics Using SQL Server Management Studio (Cont’d)
Title
Database Forensics Using SQL Server Management Studio (Cont’d)
Title
Database Forensics Using SQL Server Management Studio (Cont’d)
Title
Database Forensics Using SQL Server Management Studio (Cont’d)
Title
Database Forensics Using SQL Server Management Studio (Cont’d)
Title
Database Forensics Using SQL Server Management Studio (Cont’d)
Title
Database Forensics Using SQL Server Management Studio (Cont’d)
Title
Database Forensics Using SQL Server Management Studio (Cont’d)
Title
Database Forensics Using ApexSQL DBA
Title
Database Forensics Using ApexSQL DBA (Cont’d)
Title
Database Forensics Using ApexSQL DBA (Cont’d)
Title
Database Forensics Using ApexSQL DBA (Cont’d)
Title
Database Forensics Using ApexSQL DBA (Cont’d)
Title
Database Forensics Using ApexSQL DBA (Cont’d)
Title
Database Forensics Using ApexSQL DBA (Cont’d)
Title
Database Forensics Using ApexSQL DBA (Cont’d)
Title
Understand Internal Architecture of MySQL and Structure of Data Directory
Understand Internal Architecture of MySQL and Structure of Data Directory
Internal Architecture of MySQL (Cont’d)
Structure of Data Directory
Structure of Data Directory (Cont’d)
Structure of Data Directory (Cont’d)
Structure of Data Directory (Cont’d)
Understand Information Schema and
List MySQL Utilities for Performing
Forensic Analysis
Understand Information Schema and List MySQL Utilities for Performing Forensic Analysis
Viewing the Information Schema Viewing the Informatio
MySQL Utility Programs for Forensic Analysis
Perform MySQL Forensics on WordPress
Web Application Database
Perform MySQL Forensics on WordPress Web Application Database
Common Scenario for Reference
MySQL Forensics for WordPress Website Database: Scenario 1
Scenario 1: Collect the Evidence
Scenario 1: Examine the Log Files
Scenario 1: Analyze the General Log
Scenario 1: Take Backup of the Database
Scenario 1: Create Evidence Database
Scenario 1: Select Database
Scenario 1: View Tables in the Database
Scenario 1: View Users in the Database
Scenario 1: View Columns in the Table
Scenario 1: Collect Posts Made by the User
Scenario 1: Examine the Posts Made by the User
MySQL Forensics for WordPress Website Database: Scenario 2
MySQL Forensics for WordPress Website Database: Scenario 2
Scenario 2: Collect the Database and All the Logs
Scenario 2: Examine the Binary Logs
Scenario 2: Examine the Binary Logs (Cont’d)
Scenario 2: Examine the Binary Logs (Cont’d)
Scenario 2: Examine the Binary Logs (Cont’d)
Scenario 2: Examine the Binary Logs (Cont’d)
Scenario 2: wp_users.ibd in WordPress Database
Scenario 2: wp_posts.ibd in WordPress Database