TTP: A Kit for Exploring Databases under the Hood for Security, Forensics and Data Recovery

Vesaria Llc D/B/A Grier Forensics, Pikesville MD

Investigators

Abstract

Database Management Systems (DBMS) have been used to store and process data in organizations for decades. Larger organizations use a variety of databases (commercial, open-source or custom-built) for different departments. However, neither users nor Database Administrators (DBAs) know where the data is stored or how it is processed. Most of the relational databases store internal data using universal principles that can be inferred and captured. This project builds tools that draw on these principles to offer x-ray vision into storage of many DBMS, illustrating exactly what is happening inside. This research benefits users at all levels: students, teachers, database users, DBAs and forensic analysts. Tools developed by the research team will let DBAs inspect storage and observe any leaking data and help forensic analysts discover what happened in a database during an attack. Users will be able to restore data that was deleted or recover in the face of a critical corruption event. The same tools also help students to better understand concepts of database operations in introductory courses and help them observe security vulnerabilities. Some DBMS' provide profiling and recovery tools, but the available functionality is always database-specific and varies wildly across different platforms. This research project standardizes basic profiling and data recovery capabilities and deliver a universal solution for most major relational DBMS. This solution will include recovery against corruption events that can cause data loss or incapacitate any modern DBMS; reconstruction of "unrecoverable" (i.e., discarded or deleted) data; and visualizing artifacts that will offer insight to forensic analysts. The tools built in this project will focus on providing easy-to-use and intuitive visualization of all deconstructed DBMS content from disk and RAM and recommend strategies for minimizing data leaks. Development and evaluation will be done in collaboration with IT professionals and academic DBAs as well as industry partners. This project will also produce a suite of standard benchmarks that can quantify data leakage and recovery rates for different databases. Finally, the visualization tools and benchmarks will be combined into training tutorials and student lessons both for database and security curricula.