基于内容雕刻的MS SQL数字取证方法

MS SQL digital forensics based on content carving

为有效解决MSSQL(SQL Server)数据库文件损坏无法读取数据,以及数据误删无法恢复的问题,提出一种基于内容雕刻的MS SQL数字取证技术。通过对MS SQL内部储存结构进行解析,以页为单位进行细粒度数据恢复,根据内部系统表页面,对数据进行有效还原。实验结果表明,该技术相对已有数据库数字取证技术,对于损坏数据文件恢复效果可提升40%,且无需借助日志文件即可对已删除数据进行恢复。

The damage file of MSSQL(SQL Server)database can not be read,and the data deleted by mistake can not be recove-red.To solve the problem,a digital forensics technology of MS SQL based on content carving was proposed.The internal sto-rage structure of MS SQL was analyzed and the page was taken as a unit for fine-grained data recovery.Experimental results show that compared with the existing database digital forensics technology,the recovery effect of damaged data files can be improved by 40%,and the deleted data can be recovered without the help of log files.