Forensic Investigator (Part 7 of 10): Database Forensics

MySQL, Oracle or MS SQL server….which is it running? How do you know? Oracle may be the number one database on the market today, but what does that mean for us as investigators? Coming up, we will be looking at various database management systems and how they work with data. We will dive into Oracle databases, MySQL databases and MS SQL databases so we know where we can look for potential evidence. We will also take a look at some tools and techniques that will allow us to gather the data for our case against the perpetrators. This course contains the following lessons:

Lesson 1:

• Database Forensics
• Database Review
• Popular DBMS.

Lesson 2:

• Oracle
• Oracle Logical Structure
• Data Blocks
• System Change Number (SCN)
• Where to Look in Oracle
• System Global Area
• Where to Look in Oracle, Continued
• Oracle Forensic Tools.

Lesson 3:

• MySQL
• Data Directory
• Log Files for MySQL
• Were to Look in MySQL
• MySQL Forensic Tools.

Lesson 4:

• Microsoft SQL Server
• Data Storage
• Where to Look on MS SQL Server
• Tools for MS SQL Forensics
• SQL Server Management Studio
• ApexSQL.