A New Forensic Framework for NoSQL Databases: Wide-Column as Case Studies

Digital forensics is the procedure of collecting, analysing and providing proper documentation of all valid digital evidence from electronic devices such as computers, smartphones, cameras and networks of these devices. NoSQL forensics is the process of analysing and extracting data from non-relational databases, such as MongoDB, Cassandra, or Redis. NoSQL forensics can be used for various purposes, such as investigating cybercrimes, auditing security breaches, or recovering lost data. NoSQL forensics requires specialised tools and techniques to deal with the challenges of schema-less, distributed, and heterogeneous data models. In this paper, we propose a six-phase forensic investigation framework for the wide-column store NoSQL DBMS. Unlike previous studies that focused on specific aspects of NoSQL forensics, such as transaction log analysis or deleted data recovery, our framework covers the entire process of forensic investigation, from preparation to reporting. We also address the challenges of identifying and analysing distributed evidence in a NoSQL environment, which is different from the relational DBMS. Our framework applies to various documents as well as wide-column store NoSQL DBMSs, such as MongoDB, CouchDB, and Cassandra. To demonstrate its effectiveness, we conduct a case study using Cassandra as an example.