• Proceedings of the Korea Information Processing Society Conference
• /
• 2017.11a
• /
• pp.349-352
• /
• 2017

파일시스템 포렌식으로 삭제된 파일을 복구할 수 있지만 데이터베이스에서 이용한 데이터 파일의 경우 레코드는 복구할 수 없다. 따라서 데이터베이스 포렌식이 연구되고 있다. 데이터베이스 포렌식은 각 데이터베이스 고유 저장 특성을 이용하여 데이터파일에서 삭제된 레코드를 추출하는 기법이다. 그러나 칼럼 정보를 얻지 못할 경우 기존 데이터베이스 포렌식으로는 레코드 복구가 불가능하다. 데이터 파일의 구성단위인 페이지를 읽어 칼럼구조를 유추하면 레코드를 복원할 가능성이 있다. 본 논문은 칼럼 정보 없이 데이터 파일에 레코드가 저장된 형태를 분석하여 삭제된 레코드를 포함한 파일에 잔존하는 레코드를 복구를 위한 분석과 실험을 하였다.

• KIPS Transactions on Computer and Communication Systems
• /
• v.6 no.12
• /
• pp.487-496
• /
• 2017

In MySQL InnoDB, there are two ways of storing data. One is to create a separate tablespace for each table and store it separately. Another is to store all table and index information in a single system tablespace. You can use this information to recover deleted data from the record. However, in most of the current database forensic studies, the former is actively researched and its structure is analyzed, whereas the latter is not enough to be used for forensics. Both approaches must be analyzed in terms of database forensics because their storage structures are different from each other. In this paper, we propose a method for recovering deleted records in a method of storing records in IBDATA file, which is a single system tablespace. First, we analyze the IBDATA file to reveal its structure. And introduce delete record recovery algorithm which extended to an unallocated page area which was not considered in the past. In addition, we show that the recovery rate is improved up to 68% compared with the existing method through verification using real data by implementing the algorithm as a tool.

• KIPS Transactions on Computer and Communication Systems
• /
• v.6 no.2
• /
• pp.59-66
• /
• 2017

MySQL database is the second place in the market share of the current database. Especially InnoDB storage engine has been used in the default storage engine from the version of MySQL5.5. And many companies are using the MySQL database with InnoDB storage engine. Study on the structural features and the log of the InnoDB storage engine in the field of digital forensics has been steadily underway, but for how to restore on a record-by-record basis for the deleted data, has not been studied. In the process of digital forensic investigation, database administrators damaged evidence for the purpose of destruction of evidence. For this reason, it is important in the process of forensic investigation to recover deleted record in database. In this paper, We proposed the method of recovering deleted data on a record-by-record in database by analyzing the structure of MySQL InnoDB storage engine. And we prove this method by tools. This method can be prevented by database anti forensic, and used to recover deleted data when incident which is related with MySQL InnoDB database is occurred.

• Journal of KIISE:Software and Applications
• /
• v.26 no.2
• /
• pp.223-233
• /
• 1999

데이터베이스 공유 시스템(Database Sharing System : DSS) 은 고성능의 트랜잭션 처리를 위해 제안된 구조이다. DSS에서 고속의 통신망으로 연결된 노드들은 별도의 메모리와 운영체제, 그리고 DBMS를 가지며, 데이터베이스르 저장하고 있는 디스크는 모든 노드에 의해 공유된다. 빈번한 디스크 액세스를 피하기 위해 각 노드는 자신의 메모리 버퍼에 최근에 액세스한 페이지들을 캐싱한다. 본 논문에서는 레코드와 같은 미세 단위의 로킹을 지원하는 DSS에서 데이터베이스를 정확한 상태로 복구할 수 있는 회복 기법인 DRCP(Database Recovery using Cached Pages)를 제안한다. DRCP는 정상적으로 동작하고 있는 다른 노드에 캐싱된 페이지의 내용을 참조하여 회복 작업을 수행함으로써 디스크 액세스 수와 회복 과정에서 필요한 로그 스캔의 범위를 줄일 수 있고 , 그 결과 데이터베이스를 빨라 복구할 수 있다는 장점을 갖는다.

• Journal of the Korea Society of Computer and Information
• /
• v.27 no.12
• /
• pp.9-16
• /
• 2022

In this paper, we propose a plan to design and utilize the RDBS(Record Block Data file management System) so that data can be recovered when data files in the Combat Management System are mismatched. The CMS(Combat Management System) manages the same files in multiple IPN(Infomation Processing Node) repositories to support multiplexing. However, mismatches in data files can occur due to equipment maintenance or user immaturity. The existing CMS does not manage the history of changes in data files, and when a mismatch occurs, data file were synchronized based on the latest date. But, It is difficult to say that files with the latest date have the highest reliability, and once the file synchronization has progressed, it cannot be recovered with pre-synchronization data. To solve this problem, data was stored and synchronized in units of record blocks using RDBS proposed in this paper, and the Rsync algorithm was used to reduce the overhead of file synchronization due to units of record blocks. SW applied with RDBS was tested for performance in a simulated environment, and it was confirmed that it could be applied to CMS through normal operation confirmation.