The impact of triggers on forensic acquisition and analysis of databases

Loading...
Thumbnail Image

Authors

Hauger, W.K. (Werner)
Olivier, Martin S.

Journal Title

Journal ISSN

Volume Title

Publisher

South African Institute of Electrical Engineers

Abstract

An aspect of database forensics that has not received much attention in the academic research community yet is the presence of database triggers. Database triggers and their implementations have not yet been thoroughly analysed to establish what possible impact they could have on digital forensic analysis methods and processes. This paper firstly attempts to establish if triggers could be used as an anti-forensic mechanism in databases to potentially disrupt or even thwart forensic investigations. Secondly, it explores if triggers could be used to manipulate ordinary database actions for nefarious purposes and at the same time implicate innocent parties. The database triggers as defined in the SQL standard were studied together with a number of database trigger implementations. This was done in order to establish what aspects of a trigger might have an impact on digital forensic analysis. It is demonstrated in this paper that certain database forensic acquisition and analysis methods are impacted by the possible presence of non-data triggers. This is specific to databases that provide non-data trigger implementations. Furthermore, it finds that the forensic interpretation and attribution processes should be extended to include the handling and analysis of all database triggers. This is necessary to enable a more accurate attribution of actions in all databases that provide any form of trigger implementations.

Description

“The Role of Triggers in Database Forensics”, by Werner Hauger and Martin Olivier which appeared in the Proceedings of Information Security South African (ISSA) 2014, Johannesburg, 13 & 14 August 2014.

Keywords

Database forensics, Database triggers, Digital forensic analysis, Methods, Processes

Sustainable Development Goals

Citation

Hauger, WK & Olivier, MS 2015, 'The impact of triggers on forensic acquisition and analysis of databases', SAIEE Africa Research Journal, vol. 106, no. 2, pp. 64-73.