Database Forensics Paresh Motiwala - SQL Solutions Architect at

yout text here

1. Introduction 2. Goals 3. Breaches 4. File Formats 5. Methodology 6. Incident Preparedness 7. Incident Verification 8. Artifacts- Collection, Verification, Analysis 9. Log Readers 10. Demo 11. Q&A 12. Bibliography

Database Forensics 1. Introduction 2. Goals 3. Breaches 4. File Formats 5. Methodology 6. Incident Verification 7. Artifacts- Collection, Verification, Analysis 8. Log Readers 9. Demo 10. Q&A 11. Bibliography

Database Forensics Goals a)Prove or disprove the occurrence of a data security breach b)Determine the scope of a database intrusion c)Retrace user DML and DDL operations d)Identify data pre- and post-transactions e)Recover previously deleted database data

Database Forensics Introduction a)Breaches b)eDiscovery

Database Forensics Breaches

Database Forensics File Formats

Database Forensics Methodologies Investigation Preparedness Incident Verification Artifact Collection Artifact Analysis

Database Forensics Incident Preparedness 1. Configure your forensics workstation(Server/WS) 2. Create a SQL Server forensics IRT 3. Develop SQL Server incident response scripts. 4. Integrate base scripts with automated live forensic suites (optional).

Database Forensics Incident Verification yout text here Identifying signs of penetration: A. SQL Server Penetration B. Active unauthorized SQL Server Connections C. Past unauthorized SQL Server access a) SQL Server error logs b) Plan Cache c) Session details

Database Forensics Artifacts 1. Volatile: 1. ( sqlcmd- :out c:\dbse_loginfo.txt, dbcc loginfo go) ; 2. select * FROM sys.dm_os_ring_buffers WHERE ring_buffer_type = 'RING_BUFFER_SECURITY_ERROR‘; 3. Data Cache, Plan Cache, Recent executed statements, Active connections, Active sessions, Active VLFs, Ring Buffers 2. Non-Volatile- Default Trace Files 3. Pre-planned 4. Configuration 5. Constant update ItemImportanceVolatilityPriority SQL Server Connections & Sessions550 Transaction Logs541 SQL Server Logs433 SQL Server Database Files325 System Event Logs226

Database Forensics Artifacts –Collection Summary of Volatile SQL Server Artifacts Volatile SQL Server Artifacts Automate d Artifact Collection (WFT) Ad Hoc Artifact Collection Data cache ♦ Cache clock hands ♦ Plan cache ♦ Most recently executed (MRE) statements ♦ Active connections ♦ Active sessions ♦ Active virtual log files (VLFs) ◊ ♦ Ring buffers ♦

Database Forensics Artifacts –Analysis 1. Pre analysis – Create an Image Use write blockers Create a repository (database) 2. Security Audit- Use of Honeypot... Audit level Log history History of suspect 3. SQL Logs 4. System Event Viewer Logs 5. Profiler-Trace or Monitoring software like Idera

Database Forensics Log Readers 1. Expensive 2. Pre-planned 3. Configuration 4. Constant update

Database Forensics Q&A - Bibliography SQL Server Forensic Analysis By: Kevvie Fowler Fowler, K. (2007). Forensic analysis of a sql server 2005 database. Informally published manuscript,.

Database Forensics As prudent investigators, our job is to find the clues that the perpetrator doesn’t know he/she left behind. William Petersen CSI 2001

Explore Everything PASS Has to Offer Free SQL Server and BI Web Events Free 1-day Training Events Regional Event Local User Groups Around the World Free Online Technical Training This is CommunityBusiness Analytics Training Session Recordings PASS Newsletter