Browse > Article
http://dx.doi.org/10.13089/JKIISC.2017.27.2.223

Comparison of Remaining Data According to Deletion Events on Microsoft SQL Server  

Shin, Jiho (International Cybercrime Research Center, Korean National Police University)
Publication Information
Journal of the Korea Institute of Information Security & Cryptology / v.27, no.2, 2017 , pp. 223-232 More about this Journal
Abstract
Previous research on data recovery in Microsoft SQL Server has focused on restoring data based on in the transaction log that might have deleted records exist. However, there was a limit that was not applicable if the related transaction log did not exist or the physical database file was not connected to Server. Since the suspect in the crime scene may delete the data records using a different deletion statements besides "delete", we need to check the remaining data and a recovery possibility of the deleted record. In this paper, we examined the changes "Page Allocation information" of the table, "Unallocation deleted data", "Row Offset Array" in the page according to "delete", "truncate" and "drop" events. Finally it confirmed the possibility of data recovery and availability of management tools in Microsoft SQL Server digital forensic investigation.
Keywords
Microsoft SQL Server; Database; Delete; Truncate; Drop; Recovery; Page;
Citations & Related Records
연도 인용수 순위
  • Reference
1 Korean Police Investigation Academy, "The Advanced Course of Digital Forensic", KPIA, Jun. 2013.
2 Theo Haerder and Andreas Reuter, "Theo Principles of Transaction-Oriented Database Recovery," ACM Computing Surveys (CSUR), vol. 15, no. 4, pp. 287-317, 1983.   DOI
3 Park Soo-Young, "A Research for Record Recovery Method in Database," the Degree of Master Thesis, Korea University, Dec, 2013.
4 Ryu Gi-Hwan, "A Study for Recovering Records of Microsoft SQL Server's Database," Degree of Master Thesis, Korea University, Dec, 2014.
5 Microsoft Technet, Data Manipulation Language (DML) Statements (Transact-SQL), https://technet.microsoft.com/en-us/library/ff848799(v=sql.110).aspx
6 Microsoft Technet, Data Definition Language (DDL) Statements (Transact-SQL), https://technet.microsoft.com/en-us/library/ff848799(v=sql.110).aspx
7 WIKIPEDIA, Microsoft SQL Server, https://en.wikipedia.org/wiki/Microsoft_SQL_Server
8 Microsoft Technet, Understanding Pages and Extents, https://technet.microsoft.com/ko-kr/library/ms190969(v=sql.105).aspx
9 Itzik Ben-Gan, Microsoft SQL Server 2012 T-SQL Fundamentals, 1st ED., Microsoft Press, Jul. 2012.
10 Microsoft Technet, Deleting All Rows by Using TRUNCATE TABLE, https://technet.microsoft.com/ko-kr/library/ms188249(v=sql.105).aspx
11 Son Ho-Sung, Deep inside T-SQL Query Technique, 1st ED., Youngjin, Jul. 2004.