Categorization and Organization of Database Forensic Investigation Processes

• Published in: IEEE access Vol. 8; pp. 112846 - 112858
• Main Authors: Al-Dhaqm, Arafat, Razak, Shukor Abd, Dampier, David A., Choo, Kim-Kwang Raymond, Siddique, Kamran, Ikuesan, Richard Adeyemi, Alqarni, Abdulhadi, Kebande, Victor R.
• Format: Journal Article
• Language: English
• Published: Piscataway IEEE 2020; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Adaptation models; Data models; database forensic investigation; Database forensics; Digital data; Digital forensics; Forensic computing; investigation process model; Servers; Terminology
• ISSN: 2169-3536; 2169-3536
• DOI: 10.1109/ACCESS.2020.3000747

Database forensic investigation (DBFI) is an important area of research within digital forensics. It's importance is growing as digital data becomes more extensive and commonplace. The challenges associated with DBFI are numerous, and one of the challenges is the lack of a harmonized DBFI process for investigators to follow. In this paper, therefore, we conduct a survey of existing literature with the hope of understanding the body of work already accomplished. Furthermore, we build on the existing literature to present a harmonized DBFI process using design science research methodology. This harmonized DBFI process has been developed based on three key categories (i.e. planning, preparation and pre-response, acquisition and preservation, and analysis and reconstruction). Furthermore, the DBFI has been designed to avoid confusion or ambiguity, as well as providing practitioners with a systematic method of performing DBFI with a higher degree of certainty.