Using internal MySQL/InnoDB B-tree index navigation for data hiding

Abstract

Large databases provide interesting environments for hiding data. These databases store massive amounts of diverse data, they are riddled with internal mechanisms and data pools for enhancing performance, and they contain complex optimization routines that constantly change portions of the underlying file environments. The databases are valuable targets for attackers who wish to manipulate search results or hide traces of data access or modification. Despite its importance, research on data hiding in databases is relatively sparse. This chapter describes several data hiding techniques in MySQL and demonstrates the impact of data deletion on forensic analysis.