Forensic Attribution Challenges During Forensic Examinations of Databases
Total Page:16
File Type:pdf, Size:1020Kb
Forensic Attribution Challenges During Forensic Examinations Of Databases by Werner Karl Hauger Submitted in fulfilment of the requirements for the degree Master of Science (Computer Science) in the Faculty of Engineering, Built Environment and Information Technology University of Pretoria, Pretoria September 2018 Publication data: Werner Karl Hauger. Forensic Attribution Challenges During Forensic Examinations Of Databases. Master's disser- tation, University of Pretoria, Department of Computer Science, Pretoria, South Africa, September 2018. Electronic, hyperlinked versions of this dissertation are available online, as Adobe PDF files, at: https://repository.up.ac.za/ Forensic Attribution Challenges During Forensic Examinations Of Databases by Werner Karl Hauger E-mail: [email protected] Abstract An aspect of database forensics that has not yet received much attention in the aca- demic research community is the attribution of actions performed in a database. When forensic attribution is performed for actions executed in computer systems, it is nec- essary to avoid incorrectly attributing actions to processes or actors. This is because the outcome of forensic attribution may be used to determine civil or criminal liabil- ity. Therefore, correctness is extremely important when attributing actions in computer systems, also when performing forensic attribution in databases. Any circumstances that can compromise the correctness of the attribution results need to be identified and addressed. This dissertation explores possible challenges when performing forensic attribution in databases. What can prevent the correct attribution of actions performed in a database? The first identified challenge is the database trigger, which has not yet been studied in the context of forensic examinations. Therefore, the dissertation investigates the impact of database triggers on forensic examinations by examining two sub questions. Firstly, could triggers due to their nature, combined with the way databases are forensically acquired and analysed, lead to the contamination of the data that is being analysed? Secondly, can the current attribution process correctly identify which party is responsible for which changes in a database where triggers are used to create and maintain data? The second identified challenge is the lack of access and audit information in NoSQL databases. The dissertation thus investigates how the availability of access control and logging features in databases impacts forensic attribution. The database triggers, as defined in the SQL standard, are studied together with a number of database trigger implementations. This is done in order to establish, which aspects of a database trigger may have an impact on digital forensic acquisition, anal- ysis and interpretation. Forensic examinations of relational and NoSQL databases are evaluated to determine what challenges the presence of database triggers pose. A num- ber of NoSQL databases are then studied to determine the availability of access control and logging features. This is done because these features leave valuable traces for the forensic attribution process. An algorithm is devised, which provides a simple test to determine if database triggers played any part in the generation or manipulation of data in a specific database object. If the test result is positive, the actions performed by the implicated triggers will have to be considered in a forensic examination. This dissertation identified a group of database triggers, classified as non-data trig- gers, which have the potential to contaminate the data in popular relational databases by inconspicuous operations, such as connection or shutdown. It also established that database triggers can influence the normal flow of data operations. This means what the original operation intended to do, and what actually happened, are not necessarily the same. Therefore, the attribution of these operations becomes problematic and incorrect deductions can be made. Accordingly, forensic processes need to be extended to include the handling and analysis of all database triggers. This enables safer acquisition and analysis of databases and more accurate attribution of actions performed in databases. This dissertation also established that popular NoSQL databases either lack sufficient access control and logging capabilities or do not enable them by default to support attribution to the same level as in relational databases. Keywords: Digital Forensics, Database Forensics, Forensic Attribution, Database Trig- gers, Relational Databases, NoSQL Databases. Supervisor : Prof. Martin S. Olivier Department : Department of Computer Science Degree : Master of Science \We choose to ... do the other things, not because they are easy, but because they are hard, because that goal will serve to organize and measure the best of our energies and skills, because that challenge is one that we are willing to accept, one we are unwilling to postpone, and one which we intend to win." John F. Kennedy (1963) \Quod scripsi, scripsi (What I have written, I have written)" Pontius Pilate (AD 36) Acknowledgements I wish to express my sincere thanks and gratitude to: • My parents who supported my decision to return to academia and continue with my studies. You supported and encouraged me throughout this endeavour; • Professor Martin S. Olivier for reactivating my academic mindset and his help, guidance and support over all the years; • All the members of the ICSA research group with whom I could exchange ideas and discuss my research (Victor, Stacy, Richard, Avinash). This dissertation is dedicated to my late father who unfortunately could not see its conclusion. Contents List of Figuresv List of Tables vi 1 Introduction1 1.1 Motivation...................................2 1.2 Objective...................................7 1.3 Problem Statement..............................9 1.4 Approach................................... 10 1.5 Dissertation Outline............................. 11 2 Database Systems Overview 14 2.1 Database History............................... 14 2.1.1 Network Era.............................. 15 2.1.2 Hierarchical Era............................ 16 2.1.3 Relational Era............................. 16 2.1.4 Object Oriented Era......................... 18 2.1.5 Object Relational Era........................ 18 2.1.6 NoSQL Era.............................. 19 2.2 Relevant Database Models.......................... 19 2.2.1 Relational Databases......................... 19 2.2.2 NoSQL Databases.......................... 20 2.2.3 NoSQL Database Types....................... 22 2.3 Database Triggers............................... 24 i 2.4 Conclusion................................... 27 3 Digital Forensic Science Overview 28 3.1 Forensics.................................... 28 3.1.1 Digital Forensics........................... 29 3.1.2 Database Forensics.......................... 31 3.2 Attribution.................................. 32 3.2.1 General Attribution.......................... 32 3.2.2 Forensic Attribution......................... 34 3.3 Conclusion................................... 37 4 Database Forensics Research 39 4.1 Research Classification............................ 40 4.2 Literature Survey............................... 42 4.3 Discussion................................... 48 4.4 Possible Explanations............................. 51 4.5 Conclusion................................... 56 5 Database Trigger Implementations 58 5.1 Investigation Context............................. 58 5.2 Specification.................................. 60 5.3 Standard Triggers............................... 61 5.4 Non-standard Triggers............................ 63 5.4.1 DDL Triggers............................. 64 5.4.2 Non-data Triggers........................... 65 5.5 Trigger Objects................................ 68 5.6 Conclusion................................... 68 6 Forensic Examination of Relational Databases 70 6.1 Forensic Acquisition and Analysis Implications............... 70 6.1.1 SQL Server Examination....................... 71 6.2 Forensic Interpretation Implications..................... 75 6.2.1 Identification and Forensic Attribution............... 75 ii 6.3 Discussion of Implications.......................... 80 6.4 Conclusion................................... 81 7 Trigger Identification Algorithm 82 7.1 Trigger Identification Considerations.................... 82 7.2 Top-Down Approach............................. 85 7.3 Bottom-Up Approach............................. 88 7.4 Conclusion................................... 90 8 Algorithm Implementation 91 8.1 Implementation Considerations....................... 91 8.2 Prototype Design............................... 93 8.3 Prototype Implementation Details...................... 95 8.4 Implementation Challenges.......................... 99 8.4.1 Scope/Visibility............................ 99 8.4.2 Encryption.............................. 99 8.4.3 Case Sensitivity............................ 100 8.4.4 False-Positive Errors......................... 100 8.4.5 Data Types.............................. 101 8.4.6 Recursion............................... 101 8.4.7 Performance.............................. 102 8.5 Prototype Test Details............................ 103 8.6 Conclusion................................... 104 9 Forensic Examination of NoSQL Databases 106 9.1 Survey Context................................ 107 9.2 Surveyed NoSQL databases......................... 108 9.2.1 MongoDB..............................