Research On The NoSQL Data Recovery Technology

In recent years, NoSQL database has become an important trend in database field due toits excellent performance, good scalability and support for unstructured data. However,currently the main focus of database forensics research is on relational databases. Fewresearch has stepped into the field of NoSQL databases. This paper, based on the theory andpractice of relational database forensics, studies the data recovery technology of two NoSQLdatabases: Redis and MongoDB.Firstly, this paper introduces a data recovery method for Redis which can recover thekey-value pairs and write operation commands from the database. This method iterates overeach key-value pair in the RDB file, extracting the key and value based on the storage format.It then iterates over each line of the AOF file, extracting the command content and itsparameters. Experimental results show that the proposed methods could recover most of theRedis key-value pairs from the disk RDB file and recover all the write operation commandsfrom the disk AOF file.Secondly, this paper introduces a data recovery method for MongoDB which can recoverthe records and deleted files from the database. The record recovery method could recover theundeleted and deleted records from the database based on the structure of namespace file anddata file, as well as the behavior of the deleted records and the storage format of each datatype. The deleted file recovery method is based on the GridFS file system. It first extracts allthe relevant records which store the metadata and file chunks of the deleted file. It thenreconstruct the deleted file based on the file ID and file sequence number of each file chunk.Experimental results show that the proposed methods could recover all the undeleted recordsand all the deleted records that have not been overwritten yet, as well as all the deleted fileswhich have not been overwritten and part of the deleted files which have been overwritten.This paper is a beneficial attempt to recover data from NoSQL databases. The researchresults will be of benefit to the theory and practice of database forensics field.