Forensic database reconstruction

The analysis of database artifacts can provide a wealth of information about a suspected database intrusion. A key part of this analysis is the ability to reconstruct the actions of the intruder in order to identify any data that was compromised or any modifications that took place. This research paper identifies some of the core concepts behind forensic reconstruction, and then provides a summary of current research efforts within forensic database reconstruction including the concept of the ideal log setting, a forensically aware database logging method, and the use of relational algebra and internal log structures for the reconstruction of databases.