SQL Server database forensic analysis system and method based on transaction log

Abstract

An SQL Server database evidence obtaining and analyzing system is provided. A method comprises steps of: extracting and storing administrator rights after an SQL Server database is connected; extracting binary record information about operations in an SQL Server database transaction log; then, in combination with a data table structure and data type information, analyzing specific log data of insert and delete operations; in combination with raw data in the database and a particular efficient algorithm, analyzing log data of update operations; and finally, analyzing and storing data, time and operators of various user operations on the SQL Server database. The system and method provided by the present invention provide a feasible, practical and efficient method for SQL Server database evidence obtaining.

Description

technical field [0001] The present invention relates to an analysis system and method in the field of computer forensics, in particular to a transaction log-based SQL Server database forensics analysis system and method. Background technique [0002] The SQL Server database is a relational database system launched by Microsoft Corporation. SQL Server database is an extensible, high-performance database management system involved in distributed client / server computing. It realizes the organic combination with Microsoft's operating system—Windows NT, and provides transaction-based enterprise-level Information management system scheme. [0003] A "transaction" in a SQL Server database is a series of operations performed as a single logical unit of work. A logical unit of work must have four attributes, namely atomicity, consistency, isolation, and persistence. Only when these four attributes are met can it become a transaction. Among them, atomicity means that the transacti...

AI Technical Summary

Problems solved by technology

[0007] After searching the existing technologies, it is found that Microsoft Corporation of the United States has a tool specially used for monitoring and tracking databases - SQL Server Profiler, but this tool needs to open and track databases in real time, occupying and consuming a lot of system resources

At the same time, Profiler can only record the executed SQL commands, and does not specifically analyze data changes

In addition, Log Explorer, a commercial software of Lumigent in the United States, can conduct forensic analysis on SQL Server versions before 2005, but it does not support SQL Server 2008 or later versions, and cannot perform forensic analysis on new versions

At the same time, when Log Explorer parses the MODIFY (update) operation, it will cause parsing errors due to its algorithm flaws

Images