Microsoft SQL Server数据库中删除数据的恢复

目的恢复Microsoft SQL Server数据库中删除数据。方法解析SQL Server的数据文件和日志文件结构,使用Lumigent Log Explorer软件分析提取的日志中的记录。结果从某案件提取的数据库日志文件中提取有效记录70万余条。结论该方法可以分析并且提取Microsoft SQL Server日志文件中的记录,恢复被删除数据,具有很强的实用性。     

A LOG‐MULTIPLICATIVE ASSOCIATION MODEL FOR ALLOCATING HOMICIDES WITH UNKNOWN VICTIM‐OFFENDER RELATIONSHIPS*

This research note critically evaluates conventional methods for allocating homicides with an unknown victim/offender relationship to meaningful categories, and it proposes an alternative approach. We argue that conventional methods are based on a problematic assumption, namely, that the missing data mechanism is “ignorable.” As an alternative to these methods, we propose an imputation algorithm derived from a log‐multiplicative model that does not require this assumption. We apply this technique to estimate levels of homicides disaggregated by victim/offender relationship using the Federal Bureau of Investigation's Supplementary Homicide Report (SHR) data for 1996 and 1997, and we compare the resulting estimates with those obtained from the application of conventional procedures. Our results yield a larger proportion of stranger homicides than are obtained from the conventional methods.     

Graph clustering and anomaly detection of access control log for forensic purposes

Attacks on operating system access control have become a significant and increasingly common problem. This type of security threat is recorded in a forensic artifact such as an authentication log. Forensic investigators will generally examine the log to analyze such incidents. An anomaly is highly correlated to an attacker's attempts to compromise the system. In this paper, we propose a novel method to automatically detect an anomaly in the access control log of an operating system. The logs will be first preprocessed and then clustered using an improved MajorClust algorithm to get a better cluster. This technique provides parameter-free clustering so that it automatically can produce an analysis report for the forensic investigators. The clustering results will be checked for anomalies based on a score that considers some factors such as the total members in a cluster, the frequency of the events in the log file, and the inter-arrival time of a specific activity. We also provide a graph-based visualization of logs to assist the investigators with easy analysis. Experimental results compiled on an open dataset of a Linux authentication log show that the proposed method achieved the accuracy of 83.14% in the authentication log dataset.     

Sybase SQL Anywhere备份与恢复的研究

文中对Sybase SQL Anywhere的故障、日志作详细阐述，并给出了对数据备份和恢复的多种操作方法。     

网络取证系统的技术分析与模型实现

首先分析了网络取证的基本概念，然后介绍了网络取证系统的分析过程，最后提出和设计了一个分布式网络实时取证系统的实现模型。     

Ideal log setting for database forensics reconstruction

The ability to reconstruct the data stored in a database at an earlier time is an important aspect of database forensics. Past research shows that the log file in a database can be useful for reconstruction. However, in many database systems there are various options that control which information is included in the logs. This paper introduces the notion of the ideal log setting necessary for an effective reconstruction process in database forensics. The paper provides a survey of the default logging preferences in some of the popular database management systems and identifies the information that a database log should contain in order to be useful for reconstruction. The challenges that may be encountered in storing the information as well as ways of overcoming the challenges are discussed. Possible logging preferences that may be considered as the ideal log setting for the popular database systems are also proposed. In addition, the paper relates the identified requirements to the three dimensions of reconstruction in database forensics and points out the additional requirements and/or techniques that may be required in the different dimensions.     

域名法律问题研究

域名是一种用于互联网上识别和定位计算机的地址系统。域名应归入到知识产权的范畴。域名注册机构一般不承担因域名争议引起的法律责任。域名与商标权和商号权之间易产生法律冲突。驰名商标的商标权可以延伸至域名权,将普通商标抢注为域名者主观上存在故意时构成侵犯商标权行为,巧合雷同、非商业性使用、域名注册在先、合理使用行为不侵犯商标权。     

SQL server 2000事务日志文件深入剖析

在对大型数据库进行管理和维护操作时,经常会遇到操作速度缓慢、磁盘空间不足以及数据恢复等问题,这些问题的关键常常和事务日志有关。正确维护和处理好事务日志可确保数据库系统安全及高效运转。     

IoT forensics: Exploiting unexplored log records from the HIKVISION file system

CCTV surveillance systems are IoT products that can be found almost everywhere. Their digital forensic analysis often plays a key role in solving crimes. However, it is common for these devices to use proprietary file systems, which frequently hinders a complete examination. HIKVISION is a well-known manufacturer of such devices that typically ships its products with its proprietary file system. The HIKVISION file system has been analyzed before but that research has focused on the recovery of video footage. In this paper, the HIKVISION file system is being revisited regarding the log records it stores. More specifically, these log records are thoroughly examined to uncover both their structure and meaning. These unexplored pieces of evidence remain unexploited by major commercial forensic software, yet they can contain critical information for an investigation. To further assist digital forensic examiners with their analysis, a Python utility, namely the Hikvision Log Analyzer, was developed as part of this study that can automate part of the process.     

USB Storage Device Forensics for Windows 10

Significantly increased use of USB devices due to their user‐friendliness and large storage capacities poses various threats for many users/companies in terms of data theft that becomes easier due to their efficient mobility. Investigations for such data theft activities would require gathering critical digital information capable of recovering digital forensics artifacts like date, time, and device information. This research gathers three sets of registry and logs data: first, before insertion; second, during insertion; and the third, after removal of a USB device. These sets are analyzed to gather evidentiary information from Registry and Windows Event log that helps in tracking a USB device. This research furthers the prior research on earlier versions of Microsoft Windows and compares it with latest Windows 10 system. Comparison of Windows 8 and Windows 10 does not show much difference except for new subkey under USB Key in registry. However, comparison of Windows 7 with latest version indicates significant variances.