Browse > Article
http://dx.doi.org/10.3745/KTCCS.2017.6.2.59

The Recovery Method for MySQL InnoDB Using Feature of IBD Structure  

Jang, Jeewon (고려대학교 정보보호대학원 정보보호학과)
Jeoung, Doowon (고려대학교 정보보호대학원 정보보호학과)
Lee, Sang Jin (고려대학교 정보보호대학원)
Publication Information
KIPS Transactions on Computer and Communication Systems / v.6, no.2, 2017 , pp. 59-66 More about this Journal
Abstract
MySQL database is the second place in the market share of the current database. Especially InnoDB storage engine has been used in the default storage engine from the version of MySQL5.5. And many companies are using the MySQL database with InnoDB storage engine. Study on the structural features and the log of the InnoDB storage engine in the field of digital forensics has been steadily underway, but for how to restore on a record-by-record basis for the deleted data, has not been studied. In the process of digital forensic investigation, database administrators damaged evidence for the purpose of destruction of evidence. For this reason, it is important in the process of forensic investigation to recover deleted record in database. In this paper, We proposed the method of recovering deleted data on a record-by-record in database by analyzing the structure of MySQL InnoDB storage engine. And we prove this method by tools. This method can be prevented by database anti forensic, and used to recover deleted data when incident which is related with MySQL InnoDB database is occurred.
Keywords
Database Forensic; The Database Recovery in Record; Digital Forensic; InnoDB Storage Engine; MySQL; MySQL Forensic;
Citations & Related Records
Times Cited By KSCI : 1  (Citation Analysis)
연도 인용수 순위
1 D. C. Lee and S. J. Lee, "Research of organized data extraction method for digital investigation in relational detabase system," Journal of the Korea Institute of Information Security and Cryptology, Vol. 22, No. 3, PP.565-573, 2012.
2 P. Fruhwirt and M. Huber, "InnoDB database forensics," 24th IEEE International Conference on Advanced Information Net Working and Applications (AINA). pp. 1028-1036, Apr., 2010.
3 P. Fruhwirt, P. Kieseberg, S. Schrittwieser, M. Huber, and E. Weippl, "InnoDB database forensics: Reconstructing data mani pulation queries from redo logs," Seventh International Conference on Availability, Reliability and Security (ARES), pp. 625-633, Aug., 2012
4 W. S. Noh, S. M. Jang, C. H. Kang, K. M. Lee, and S. J. Lee, "The Method of Deleted Record Recovery for MySQL MyISAM Database," Journal of the Korea Institute of Information Security and Cryptology, Vol. 26, No. 1, pp. 125-134, 2016.   DOI
5 Paul DuBois, MySQL Developer's Library, 4th Ed., Addison-Wesley Professional, Aug., 2008.
6 Oracle, SHOW COLLATION Syntax [Internet], https://dev.mysql.com/doc/refman/5.0/en /show-collation.html.
7 K. S. Lim, D. C. Lee, J. H. Park, and S. J. Lee, "A Novel Database Forensic Technique Using Table Relationship Analysis," Korea Multimedia Society Fall Conference Proceedings, pp. 65-68, 2009.