Memory-Driven Forensic Analysis of SQL Server: A Buffer Pool and Page Inspection Approach

Area of Science:

• Computer Science
• Digital Forensics
• Database Systems

Background:

• Traditional deleted data recovery methods in Microsoft SQL Server (transaction log analysis, offline file examination) lack real-time applicability and miss volatile memory data.
• Sensor-driven systems (IoT gateways, edge computing) store critical data locally in lightweight SQL engines, making them vulnerable to insider threats.
• Real-time forensic analysis is crucial for time-sensitive incidents like cyber intrusions and insider manipulation.

Purpose of the Study:

• To propose a memory-based forensic procedure for real-time recovery of deleted data in Microsoft SQL Server.
• To address the limitations of traditional methods in capturing volatile, memory-resident data.
• To enhance digital forensics capabilities for IoT and edge computing environments.

Main Methods:

• Capturing deletion event information via transaction log analysis immediately post-deletion.
• Directly inspecting memory-resident pages within the server's Buffer Pool.
• Analyzing Buffer Pool page structures and cross-referencing with log data to establish a memory-driven forensic framework.

Main Results:

• Successful partial or full recovery of deleted records in a live SQL Server environment using combined transaction log and in-memory page analysis.
• Demonstrated feasibility of real-time forensic analysis without interrupting the operational database.
• Established a memory-driven framework for recovery and verification of deleted records.

Conclusions:

• The proposed memory-based methodology enhances the speed and accuracy of digital forensics in time-sensitive scenarios.
• Real-time deleted data recovery from memory is critical for IoT sensor data integrity, forensic traceability, and system resilience.
• This approach provides a foundational methodology for prompt and precise recovery of deleted data, crucial for insider threat detection and cyber intrusion response.