veyepar: A Universal Carving Approach for Database Forensic Analysis

Author(s):	James Wagner
Location	Room LL104
Date	may Sat 07	Days Raw Files
Start	15:00	First Raw Start	14:55
Duration	30:00	Offset	0:04:36
End	15:30	Last Raw End	15:35
Chapters	00:00 0:09:01 0:19:01 0:25:59
Total cuts_time	26 min.

http://mdp.cdm.depaul.edu/DePy2016/default/schedule
raw-playlist raw-mp4-playlist encoded-files-playlist host tweet mp4 svg png

assets release.pdf A_Universal_Carving_Approach_for_Database_Forensic_Analysis.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:
Locked:	clear this to unlock
Locked by:	user/process that locked.
Start:	initially scheduled time from master, adjusted to match reality
Duration:	length in hh:mm:ss
Name:	Video Title (shows in video search results)
Emails:	email(s) of the presenter(s)
Released:	has someone authorised pubication
Normalise:
Channelcopy:	m=mono, 01=copy left to right, 10=right to left, 00=ignore.
Thumbnail:	filename.png
Description:	Forensic tools assist analysts with recovery of data and understanding system events, even when working with corrupted data storage. These tools rely on "file carving" techniques to restore files with damaged metadata by analyzing raw file content. While much of the sensitive data is stored and processed by databases, file carving tools for databases are practically non-existent because most databases (particularly commercial ones) do not document their storage formats. Internally, database content is kept in individual "pages" and follows a unique, yet consistent, set of rules for storage and maintenance. By directly accessing raw database storage, we can recover corrupted contents and reveal user activities that are hidden even from database administrators. There are a number of database-specific tools developed for recovery and monitoring purposes but they are surprisingly limited in face of corruption or "unintentional" side-effects caused by normal database execution. In this talk, we present a universal tool that seamlessly supports many different databases, rebuilding table and other data content from any remaining storage fragments on disk or in memory. We also demonstrate just how much activity takes place under the hood of a database and present an overview of some things that can be discovered by directly investigating database internals. markdown
Comment:	production notes