Schema reconstruction in database forensics

Abstract

Although considerable research has been conducted in the area of database forensics over the past few years, several aspects of database foren-sics remain to be considered. One of the challenges facing database forensics is that the results of forensic analysis may be inconsistent with the raw data contained in a database because of changes made to the metadata. This paper describes the various types of changes that can be made to a database schema by an attacker and shows how metadata changes can affect query results. Techniques for reconstructing the original database schema are also described.