Database Forensics

Paresh Motiwala
- SQL Solutions Architect at www.actifio.com
 yout text here
pareshmotiwala@gmail.com
http://www.linkedin.com/in/pareshmotiwala
http://www.facebook.com/pareshmotiwala
http://www.circlesofgrowth.com
1. Introduction
2. Goals
3. Breaches
4. File Formats
5. Methodology
6. Incident Preparedness
7. Incident Verification
8. Artifacts- Collection, Verification, Analysis
9. Log Readers
10. Demo
11. Q&A
12. Bibliography
 Database Forensics
1. Introduction
2. Goals
3. Breaches
4. File Formats
5. Methodology
6. Incident Verification
7. Artifacts- Collection, Verification, Analysis
8. Log Readers
9. Demo
10. Q&A
11. Bibliography
Database Forensics
Goals
a) Prove or disprove the occurrence of a data security breach
b) Determine the scope of a database intrusion
c) Retrace user DML and DDL operations
d) Identify data pre- and post-transactions
e) Recover previously deleted database data
Database Forensics
Introduction

a) Breaches
b) eDiscovery
Database Forensics
Breaches
Database Forensics
File Formats
Database Forensics
Methodologies
Investigation Incident Artifact Artifact
Preparedness Verification Collection Analysis
Database Forensics
Incident Preparedness
1. Configure your forensics workstation(Server/WS)
2. Create a SQL Server forensics IRT
3. Develop SQL Server incident response scripts.
4. Integrate base scripts with automated live
forensic suites (optional).
Database Forensics
Incident Verification
Identifying signs of penetration:
A. SQL Server Penetration
B. Active unauthorized SQL Server
Connections
C. Past unauthorized SQL Server access
a) SQL Server error logs yout text here
b) Plan Cache
c) Session details
Database Forensics
Artifacts
1. Volatile:
1. ( sqlcmd- :out c:\dbse_loginfo.txt, dbcc loginfo go) ;
2. select * FROM sys.dm_os_ring_buffers WHERE ring_buffer_type =
'RING_BUFFER_SECURITY_ERROR‘;
3. Data Cache, Plan Cache, Recent executed statements, Active connections,
Active sessions, Active VLFs, Ring Buffers

2. Non-Volatile- Default Trace Files Item Importance Volatility Priority

3. Pre-planned
SQL Server Connections & Sessions 5 5 0
4. Configuration Transaction Logs 5 4 1
SQL Server Logs 4 3 3
5. Constant update SQL Server Database Files 3 2 5
System Event Logs 2 2 6
 Summary of Volatile SQL Server

Database Forensics
Artifacts
Automate
d Artifact Ad Hoc
Artifacts –Collection Volatile SQL Collection Artifact
Server Artifacts (WFT) Collection
Data cache ♦
Cache clock ♦
hands
Plan cache ♦
Most recently ♦
executed (MRE)
statements
Active ♦
connections
Active sessions ♦
Active virtual log ◊ ♦
files (VLFs)
Ring buffers ♦
Database Forensics
Artifacts –Analysis 1. Pre analysis –
• Create an Image
• Use write blockers
• Create a repository (database)
2. Security Audit- Use of Honeypot...
• Audit level
• Log history
• History of suspect
3. SQL Logs
4. System Event Viewer Logs
5. Profiler-Trace or Monitoring software like Idera
Database Forensics
Log Readers
1. Expensive
2. Pre-planned
3. Configuration
4. Constant update
Database Forensics
Q&A - Bibliography

http://www.bmyers.com/public/1958.cfm

SQL Server Forensic Analysis By: Kevvie Fowler

Fowler, K. (2007). Forensic analysis of a sql server 2005
database. Informally published manuscript, .
Database Forensics

As prudent investigators, our job is

to find the clues that the
perpetrator doesn’t know he/she
left behind.
William Petersen
CSI 2001
Explore Everything PASS Has to Offer

Free SQL Server and BI Web Events Free 1-day Training Events Regional Event

Local User Groups Around

This is Community Business Analytics Training
the World

Session Recordings PASS Newsletter Free Online Technical Training