Forensic Deconstruction of Databases through Direct Storage Carving

Explore forensic database analysis techniques in this 43-minute conference talk from CypherCon 2.0. Delve into the intricacies of database components, file carving, and direct storage carving methods. Learn about database pages, parameter detection, and value construction. Examine stochastic forensics, Windows time steps, and database caching, with a focus on Oracle Buffer Cache. Understand delete operations through examples and explanations. Discover database carving solutions and gain insights into preventing evidence contamination. This talk also touches on job opportunities in the field of database forensics.

Syllabus

Introduction
Why have we bothered
Database components
Detour
File Carving
Database Pages
Parameter Detector
Database Parameters
Value Construction
Example Data
Stochastic forensics
Windows time steps
Storage
Database Caching
Oracle Buffer Cache
Delete Example
Delete Explained
Delete Examples
Database Carving Solutions
Job Opening
How do you prevent evidence contamination