Database auditing and forensics: Exploration and evaluation

Database auditing is a prerequisite in the process of database forensics. Log files of different types and purposes are used in correlating evidence related to forensic investigation. In this paper, a new framework is proposed to explore and implement auditing features and DBMS-specific built-in utilities to aid in carrying out database forensics. The new framework is implemented in three phases, where ideal forensic auditing settings are suggested, techniques and approaches to conduct forensics are evaluated, and finally database forensic tools are investigated and evaluated. The research findings serve as guidelines toward focusing on database forensics. There is a crucial need to fill in the gap where forensic tools are few and not database specific.