Insight Into Database Forensics

Authors: Enas K., Fatimah A., Abeer A., Ghadah A.

Abstract:

Database forensics is a specialized field of digital forensics that investigates and analyzes database systems to recover and evaluate data, particularly in cases of cyberattacks and data breaches. The increasing significance of securing data confidentiality, integrity, and availability has emphasized the need for robust forensic models to preserve data integrity and maintain the chain of evidence. Organizations rely on Database Forensic Investigation (DBFI) to protect critical data, maintain trust, and support legal actions in the event of breaches. To address the complexities of relational and non-relational databases, structured forensic frameworks and tools have been developed. These include the Three-Tier Database Forensic Model (TT-DF) for comprehensive investigations, blockchain-backed logging systems for enhanced evidence reliability, and the FORC tool for mobile SQLite database forensics. Such advancements facilitate data recovery, identify unauthorized access, and reconstruct events for legal proceedings. Practical demonstrations of these tools and frameworks further illustrate their real-world applicability, advancing the effectiveness of database forensics in mitigating modern cybersecurity threats.

Keywords: database forensics, cybersecurity, SQLite forensics, digital forensics