Research On InnoDB Data Carving Technology

Data recovery is an important technology in the field of database forensics, butcurrently data recovery techniques focus on recovering records and SQL statements.Few studies specially involve restoring records of a table on the basis of the tablestructure, thus making it difficult to recover records of dropped tables. The mostwidely used InnoDB database in MySQL is chosen as the research object.The paperresearches recovery techniques of records of tables based on table definition files orredo log files.Firstly, this paper proposes a method to recover data in InnoDB database basedon table definition files. This method reconstructs table definition files from a diskimage using file carving method. Then it obtains table structure from table definitionfiles, matches table structure and leaf pages, extracts leaf pages from the disk image,and then finally extracts table records from the leaf pages. Experiments show that theproposed method can recover the table records from the disk. This method canrecover undropped and dropped tables. This method has high precision because ofcomprehensive information in table definition files. This approach also has limitations.When table definition files are damaged, this method is useless.Secondly, this paper presents a method to recover data in InnoDB database basedon redo log files. By analyzing the related redo log entries produced when InnoDBtable is created, the recovery method can recover table structure and match tablestructure and leaf pages. Then the recovery method extracts leaf pages from the diskimage and finally extracts records by applying table structure on the matched leafpages. Experiments show that the proposed method can recover the table records fromthe disk. This method is easier to recover the table records.In this paper, data recovery techniques in InnoDB database are addressed, theresearch results will contribute to enriching and improving the data recoverytechniques.