Low-Level Forensic Analysis for Detecting Database Evidence Manipulation

The integrity of digital evidence stored in the relational databases is a crucial part of forensic investigations and judicial processes. The current methods of database forensics are mostly based upon logs, metadata, and cryptographic hashing, which can be bypassed by skilled attackers who edit database binaries and execution code on a low-level basis. In order to mitigate this drawback, this paper introduces a low-level forensic method of detecting evidence manipulation on a database level, beyond the application and file-system layers. The methodology proposed combines forensic acquisition, binary disassembly, and comparison on a functional level to identify any unauthorized modifications to the database management system executable. As a case study, MySQL is considered, where the binary of the server was obtained in a forensically sound way and examined with the help of the IDA Pro and BinDiff in relation to the trusted reference build. The investigation revealed structural changes in important access-control operations, such as inverted conditional branches resulting in privilege escalation. The results show that binary-level forensic strategies can be used to disclose the latent manipulations that are imperceptible to the traditional logging-based forensic mechanisms. This paper highlights the importance of low-level reverse engineering as part of the database forensic practice to enhance the reliability, integrity, and admissibility of the evidence.