Test method of incomplete database file

Abstract

The invention belongs to the technical field of information security and particularly relates to a test method of an incomplete database file, which includes the following steps: A, extracting a system data storage file and determining a system table in a database; B, analyzing logic structure relationship and data storage format of each record in all tables of the database, obtaining concrete information of each field and content features of data storage in the table, and recording; C, obtaining concrete logic structure features of data recovery according to the logic structure relationship stored in the database; D, extracting characteristic data in a hard disk based on a data extraction logic algorithm, forming the data into a data table form and extracting; E, adopting data page location, non-log recovery, extraction and scheduling recombinant algorithm to automatically recover, extract and recombine residue data of canceled database file in the disk. The test method of the incomplete database file can effectively complete data information recovery in the non-log condition and has the function of case record extraction.

Description

technical field [0001] The invention belongs to the technical field of information security, and in particular relates to a method for checking an incomplete database file. Background technique [0002] At present, databases are used in various fields, and the case-related information stored in the database plays a key role in the handling of various network-related cases. For example, in an online pyramid scheme case, the actual number of members of the pyramid scheme group (after deduplication), the hierarchical relationship of the developed members, the actual profit amount of the platform, the identity information and contact information of the core members, and other involved information are stored in the database of the pyramid scheme platform. In online gambling cases, information such as the user's betting amount, account capital flow, identity information and contact information of the person involved in gambling is stored in the background database of the gambling ...

AI Technical Summary

Problems solved by technology

[0016] The present invention aims to overcome the deficiencies of the prior art and provide a solution to the location of the core data table in the database involved and the meaning analysis of the key fields in the table and the efficiency of the existing database forensic analysis method under the condition of "no log". Low cost, long period of evidence collection, etc., can effectively complete the recovery of data information, an inspection method for incomplete database files with the function of extracting records involved in the case

Images