WO2014194471A1

WO2014194471A1 - Database evidence collection method and apparatus

Info

Publication number: WO2014194471A1
Application number: PCT/CN2013/076719
Authority: WO
Inventors: 韩晟; 王盈
Original assignee: 安世盾信息技术（北京）有限公司
Priority date: 2013-06-04
Filing date: 2013-06-04
Publication date: 2014-12-11

Abstract

Disclosed are a database evidence collection method and apparatus. According to the structure of a target database and the structures of various tables contained in the target database, an empty result database having a structure consistent with that of the target database is established and saved, thus the structure of the target database can be obtained by copying; check values are obtained by checking each record of the various tables in the target database and the check value of each record in the target database is saved, thus the records in the target database can be stored; the records in the target database, meeting set conditions, are obtained, and the obtained records are saved, thus only the required record contents can be copied; therefore, the embodiment of the present invention avoids obtaining the whole contents of the target database, can simplify the operation process and improve the operation efficiency, and consequently can address the problems in the existing database evidence collection methods that the process of obtaining the target database is complex and the operation efficiency is low.

Description

Database forensics method and device

Technical field

The present invention relates to database technology, and in particular to a database forensic method and apparatus. Background technique

At present, the database forensic method usually includes: performing the backup and export operation of the entire target database, installing the same platform and the same version of the database software on the operator's computer, and then importing the exported database backup file to obtain the target database. A substantially consistent results database, the operator analyzes and forensics based on the results database.

However, since the database forensics may be used for forensics on different platforms, the above methods are used to obtain evidence for databases of different platforms, and the operators are required to be familiar with the operation methods of the various platforms. High technical requirements and inconvenient operation.

Moreover, due to the complexity of the above-mentioned database forensics method, especially in the case where the database is very large, the above method is inefficient and error-prone in the specific implementation process.

It can be seen that in the existing database forensics method, there is a problem that the process of acquiring the target database is complicated and the operation efficiency is low. Summary of the invention

In view of this, the embodiment of the present invention provides a database forensic method and device, which is used to solve the problem that the existing database forensic method has a complicated process for obtaining a target database and low operational efficiency.

The technical solutions of the embodiments of the present invention are as follows:

A database forensic method includes: establishing and saving a blank result database having a consistent structure with a target database but not including a specific data entry according to a database structure of the target database and a table structure of each table included in the target database; Each record in each table is checked to obtain a check value, and the check value of each record in the target database is saved; the record in the target database meeting the set condition is obtained, and the acquired record is saved.

A database forensic device, comprising: a first saving module, configured to establish and save a blank result database having a consistent structure with the target database according to a database structure of the target database and a table structure of each table included in the target database; The saving module is configured to check each record of each table in the target database to obtain a check value, and save the check value of each record in the target database; the third save module obtains the record in the target database that meets the set condition , save the acquired record.

Embodiments of the present invention pass a table according to a database structure of a target database and respective tables included in a target database Structure, establish and save a blank result database with a consistent structure with the target database, can copy the structure of the target database, verify the value by checking each record of each table in the target database, and save each item in the target database. The recorded check value can be used to archive the records in the target database, obtain the records in the target database that meet the set conditions, save the acquired records, and copy only the required recorded content, so that the embodiment of the present invention provides The technical solution duplicates the structure of the target database, archives the data records, and copies only the required content, and can acquire the content necessary for database forensics in the target database, thereby avoiding the acquisition of the entire content of the target database, The operation process is improved, and the operation efficiency is improved, so that the problem of obtaining the target database in the existing database forensic method is complicated and the operation efficiency is low.

Other features and advantages of the invention will be set forth in the description which follows, and The objectives and other advantages of the invention will be realized and attained by the <RTI DRAWINGS

FIG. 1 is a flowchart of a method for database forensics provided by an embodiment of the present invention;

2 is another working flowchart of a database forensics method according to an embodiment of the present invention;

3 is another working flowchart of a database forensics method according to an embodiment of the present invention;

4 is a structural block diagram of a database forensics device according to an embodiment of the present invention;

5 is another structural block diagram of a database forensics device according to an embodiment of the present invention;

6a is another structural block diagram of a database forensics device according to an embodiment of the present invention;

6b is another structural block diagram of a database forensics device according to an embodiment of the present invention;

FIG. 7a is another structural block diagram of a database forensics device according to an embodiment of the present invention;

FIG. 7b is another structural block diagram of a database forensics device according to an embodiment of the present invention;

FIG. 7c is another structural block diagram of a database forensics device according to an embodiment of the present invention;

FIG. 7 is a block diagram of another structure of a database forensics device according to an embodiment of the present invention;

FIG. 8a is another structural block diagram of a database forensics device according to an embodiment of the present invention;

FIG. 8b is another structural block diagram of a database forensics device according to an embodiment of the present invention;

9a is another structural block diagram of a database forensics device according to an embodiment of the present invention;

FIG. 9b is another structural block diagram of a database forensics device according to an embodiment of the present invention;

10a is another structural block diagram of a database forensics device according to an embodiment of the present invention;

FIG. 10b is another structural block diagram of a database forensics device according to an embodiment of the present invention;

FIG. 10c is another structural block diagram of a database forensics device according to an embodiment of the present invention;

FIG. 10 is a block diagram of another structure of a database forensics device according to an embodiment of the present invention. detailed description

The embodiments of the present invention are described in the following with reference to the accompanying drawings, and the embodiments of the invention are intended to illustrate and explain the invention.

For the problem that the process of acquiring the target database is complicated and the operation efficiency is low in the existing database forensic method, the embodiment of the present invention provides a database forensic scheme for solving the problem. In the technical solution provided by the embodiment of the present invention, only the recorded content in the required target database is copied, the structure of the target database is copied, and the contents of each record in the target database are sealed, and the target database can be obtained. The necessary content for database forensics avoids the acquisition of the entire contents of the target database, can streamline the operation process, improve the operation efficiency, and thus can solve the complicated process and operation of acquiring the target database existing in the existing database forensics method. Inefficiency; and, only copying the required content in the target database, verifying and storing all the data records of the target database, ensuring the security of the data records in the target database, and avoiding unnecessary data records being leaked. risk.

Embodiment 1

FIG. 1 is a flowchart of a method for database forensics provided by an embodiment of the present invention. The method includes: Step 101: Establish and save a target database according to a database structure of a target database and a table structure of each table included in the target database. a blank result database with a consistent structure;

Specifically, for the target database in the offline device, the database export file and/or the database backup file and/or the database file in the target database may be loaded through a preset interface to obtain the database structure of the target database and each of the target database. Table structure of the table; for the online target database of the network, it can be connected to the online target database through a preset interface according to the address information of the target database, and according to known authentication information or permission information (such as user name and user password) Obtaining the database structure of the target database and the table structure of each table included in the target database;

Specifically, the structure of the acquired target database includes: an identifier of the target database, a number of tables included in the target database, an identifier of each table, a field name included in each table, and a definition of the field;

The result database is an empty library. The result database has the same structure as the target database, that is, the identifier of the same database, the number of tables included in the database, the identifier of each table, the field names and fields of each table. Definition

Step 102: Perform verification on each record of each table in the target database to obtain a check value, and save a check value of each record in the target database;

Specifically, the primary key of each record in the target database and the recorded content of each record are respectively verified, and the primary key check value and the record content check value of each record are obtained;

And storing a primary key check value and a record content check value of each record in the target database, and storing a correspondence relationship between the primary key check value and the record content check value of each record; Specifically, the verification operation may be a HASH check, that is, the object to be verified is subjected to HASH calculation to obtain a check value of the object, that is, a HASH value; the verification operation in the following may be a HASH check, and the corresponding check value. That is the HASH value;

Step 103: Obtain a record in the target database that meets the set condition, and save the acquired record.

The record matching the set condition may be obtained in the target database by using a keyword search, a SQL query, or a conditional filter. The set condition may be set according to the needs of the specific application scenario, for example, may be a table of the target database. The data record, or part of the data record in a table, or it can be the entire data record of the target database.

Through the above process, in an application scenario such as electronic data forensics, when copying the target database, the target database is not directly exported and the exported database is imported into the target database, but only the structure and establishment of the target database are acquired. A blank result database with the same structure as the target database, which can acquire and save the structural features of the target database, and perform verification and storage on each data record in the target database, and only perform the required content, that is, the records that meet the set conditions. Copy and save, can only obtain the content that is actually needed, and the acquired content is significantly reduced compared with the prior art, and the above-mentioned automatic processing procedure is effective, and does not require the intervention of a technician, and can improve the operation efficiency, especially in having In the case of multiple target databases, the above process can significantly streamline the operation process and improve operational efficiency.

Embodiment 2

FIG. 2 is a flowchart showing another working process of the database forensic method according to the embodiment of the present invention. The method includes: Step 201: Establish and save according to a database structure of a target database and a table structure of each table included in the target database. The target database has a blank result database with a consistent structure;

Similar to the foregoing step 101, the target database in the offline device may be accessed by loading the target database, or the online target database may be accessed through a preset interface to obtain the structure of the target database, and the result database is established according to the acquired target database structure;

Establish and maintain a result database with a consistent structure with the target database, and be able to acquire and save the structural characteristics of the target database;

Step 202: Perform verification on the target database to obtain a check value of the target database, and check each table included in the target database to obtain a check value of each table; save the check value of the target database and the calibration of each table of the target database. Test value

In the application scenario of the electronic data forensics, the entire database of the target database is verified, for example, the HASH check obtains the HASH value of the target database, and the storage condition of the entire database of the target database can be sealed, that is, the overall storage feature of the target database is sealed; It is also possible to check the change of the target database according to the saved check value if necessary. The specific check operation includes: performing a HASH check on the target database at a certain time after the database forensics to obtain a check value, and comparing the Whether the check value is consistent with the check value of the target database saved in the database forensics process, Consistent circumstances indicate that the target database does not change after the forensic operation, otherwise there is a change, so as evidence of the electronic data forensics presentation, letter and shield;

Step 203: Perform a check on the blank result database to obtain a check value of the result database, and respectively check each table included in the result database to obtain a check value of each table, and save the check value of the result database and each result database. Check value of the table;

In the application scenario of electronic data forensics, the results database and each table in the result database are respectively verified, for example, HASH check, and the database structure of the blank result database can be sealed, that is, obtained during the database forensics process. The structural characteristics of the result database and the structural features of each table in the result database are sealed; it is also possible to check the change of the result database according to the saved check value if necessary, and the consistency of the result database and the target database. The comparison is checked, and the principle of the verification operation is as described in the above step 202, and will not be described here, so as evidence of the electronic data forensics presentation, the letter and the shield;

Step 204: Perform verification on the primary key of each record in the target database and the recorded content of each record, and obtain a primary key check value and a record content check value of each record; and save the primary key of each record in the target database. The verification value and the recorded content check value, and the correspondence between the primary key check value and the record content check value of each record are saved;

In the application scenario of electronic data forensics, each data record in the target database is verified and sealed, and the storage of the data record content in the target database can be sealed, thereby avoiding the content of irrelevant data records in the target database. Obtaining, to reduce the content required in the process of obtaining the target database, can reduce the content acquisition, improve the acquisition efficiency, and can avoid the risk of data record leakage and improve the data security;

Moreover, it is also possible to check the change of the data record in the target database according to the saved check value, and the principle of the check operation is as described in the above step 202, and will not be described again here, so as the presentation, the letter and the shield of the electronic data forensics. evidence of;

Step 205: Obtain a record in the target database that meets the set condition, and save the acquired record.

The operation of acquiring and saving the record that meets the set condition is as shown in step 103 above, and is not described here. In the application scenario of electronic data forensics, the record that meets the set condition is acquired and saved, and the target database that is actually needed can be obtained. Records to reduce the amount of content required to obtain the target database, reduce access to content, improve access efficiency, avoid the risk of unwanted data leakage, and ensure data security;

Step 206: Perform verification on the obtained record to obtain a check value of the record that meets the set condition, and save the obtained check value of the record that meets the set condition;

In the application scenario of the electronic data forensics, the acquired records satisfying the set conditions are verified, for example, HASH check, and the characteristics and contents of the acquired records can be sealed, so as to be in the target database if necessary. Checking the change of the records that meet the set conditions, checking the changes of the saved records that meet the set conditions, and checking the records in the target database that meet the set conditions and the records that match the set conditions. The comparison is checked, and the principle of the verification operation is as described in the above step 202, and will not be described again here, so as an electron. The basis for the analysis of data forensics, as well as evidence for presentation, confession and shield;

Step 207: Perform analysis and processing on the acquired content.

For example, based on the acquired content, the search, comparison, and association analysis, the acquired and saved content (ie, the established result database, the check value of the target database, the check value of each table of the target database, and the result database) The check value, the check value of each table of the result database, the check value of each data record of the target database, the obtained data record meeting the set condition and its check value), and the analysis result is included in the database forensics 4 in the report.

Through the foregoing processing procedure, on the basis of the first embodiment, the target database, the result database, the acquired records that meet the set conditions are respectively verified, and the check value is saved, so as to facilitate the application scenario in the electronic data forensics. The original attribute and the original content of the target database and the result database are archived, which can be used as a basis for checking the target database and the acquired content, and as evidence for credit, presentation and shield in electronic data forensics.

Embodiment 3

The embodiment of the present invention further provides a database forensic method. The method is based on the first embodiment or the second embodiment. As shown in FIG. 3, the method further includes the following processing:

Step 301: Obtain and save user information and log information of the target database.

The log information includes one or a combination of the following: a login log, an operation log, an SQL log, an import and export log, a backup log, an error log, and an alarm log, and the log information may further include other types of log information.

Obtaining and saving the log information can copy the operation of the target database, and can provide reference for subsequent analysis and processing in an application scenario such as electronic data forensics;

Step 302: Perform verification on the obtained user information and log information to obtain a check value of the user information and a check value of the log information, and save the check value of the user information and the check value of the log information.

Checking the obtained user information and log information, for example, HASH check, so that in the application scenario such as electronic data forensics, the user information and log information of the target database can be sealed without changing the user information of the target database and The original attribute and original content of the log information ensure the uniqueness and integrity of the replication target database. It can also check the change of user information and log information according to the saved check value if necessary, and check the principle of operation. As described in the above step 202, it will not be described here, so as evidence of the presentation, the letter and the shield of the electronic data forensics.

The processing procedure of FIG. 3 is not in any order with the processing procedure shown in FIG. 1. The processing procedure shown in FIG. 1 and the execution sequence of the processing procedure shown in FIG. 3 may be set according to the needs of a specific application scenario, or, as shown in FIG. The process shown in FIG. 3 is set before the step 207 of the process, and in step 207, the analysis process of the database forensic can also be performed according to the acquired log information, and the analysis result is included in the database forensics.

Through the foregoing processing procedure, based on the first embodiment or the second embodiment, the user information and the log information of the target database can be saved and verified, so as to analyze or check the user information and the log information, and Evidence of credit, presentation and shield evidence in electronic data forensics. Embodiment 4

The invention also provides a database forensic method, which further includes the following processes on the basis of the first embodiment, the second embodiment or the third embodiment:

In the case of having multiple target databases, that is, when multiple target databases are to be replicated, the content to be saved for each target database is stored in a centralized manner with a predetermined database type; wherein, the content to be saved is as described above. The saved contents listed in the first embodiment, the second embodiment or the third embodiment.

Specifically, the predetermined database type may be a database type set according to a specific application scenario requirement, for example, an oracle database, and the content of the copied multiple target databases is saved by using the set database type, and the copied and obtained may be saved in a unified database type. Content, in order to calculate the evidence in the application scenario, the association analysis of the replicated database content; in the prior art, after copying multiple target databases, the same database type for each target database for storage replication The result database, in the subsequent analysis operations, it is necessary to perform independent analysis operations in multiple systems, multiple platforms, and multiple databases, and a series of data conversion operations are required in the analysis operation. The method is high in complexity, inefficient, and error-prone; the method of the fourth embodiment of the present invention can reduce the cumbersome operation and improve the operation efficiency caused by different database types;

Centrally storing the content of forensics of multiple target databases, compared with the prior art, storing the result database in multiple physical entities, and performing related operations on the saved result database, can facilitate the analysis operation of electronic data forensics, and can improve The efficiency of the copying operation can reduce the cumbersome operation and improve the operating efficiency in subsequent analysis operations.

The processing procedure shown in the fourth embodiment is different from the processing procedure shown in FIG. 1, FIG. 2 or FIG. 3, and the processing procedure shown in FIG. 1 and the processing procedure shown in the fourth embodiment may be set according to the needs of the specific application scenario. The execution sequence, or the execution sequence of the processing procedure shown in FIG. 2 and the processing procedure shown in the fourth embodiment, or the processing sequence shown in FIG. 3 and the execution sequence of the processing procedure shown in the fourth embodiment are set.

Embodiment 5

Based on the same inventive concept, the embodiment of the present invention further provides a database forensic device. As shown in FIG. 4, the device includes:

The first saving module 401 is connected to the target database, and is configured to establish and save a blank result database having a consistent structure with the target database according to the database structure of the target database and the table structure of each table included in the target database;

The second saving module 402 is connected to the target database, and is used for verifying each record of each table in the target database to obtain a check value, and saving the check value of each record in the target database;

Specifically, the second saving module 402 respectively checks the primary key of each record in the target database and the recorded content of each record, and obtains a primary key check value and a record content check value of each record; The primary key check value and the record content check value of each record, and the correspondence between the primary key check value and the record content check value of each record are saved; The third saving module 403 is connected to the target database, obtains records in the target database that meet the set conditions, and saves the acquired records.

Preferably, as shown in FIG. 5, the database forensics apparatus provided by the embodiment of the present invention further includes: an interface module 404, connected to the target database, the first saving module 401, the second saving module 402, and the third saving module 403, Access the target database through a preset database interface.

The working principle of the device shown in Figure 4 or Figure 5 is shown in Figure 1, and will not be described here.

With the apparatus shown in Fig. 4 or Fig. 5, it is also possible to significantly cycle the operation and improve the operation efficiency.

Embodiment 6

The embodiment of the present invention further provides a database forensic device. As shown in FIG. 6a and FIG. 6b, the device is based on the device shown in FIG. 4 or FIG.

The fourth saving module 405 is connected to the first saving module 401 for verifying the target database to obtain a check value of the target database, and checking each table included in the target database to obtain a check value of each table; Check value and check value of each table of the target database;

The fifth saving module 406, or connected to the first saving module 401, performs a check on the blank result database saved by the first saving module 401 to obtain a check value of the result database, and checks each table included in the result database to obtain each The check value of the table; the check value of the target database, the check value of the result database, and the check value of each table of the result database;

The sixth saving module 407 is connected to the third saving module 403, configured to check the record acquired by the third saving module 403 to obtain a check value of the record that meets the set condition, and save the acquired matching condition. Recorded check value;

The analysis processing module 408 is connected to the first saving module 401, the second saving module 402, the third saving module 403, the fourth saving module 405, the fifth saving module 406 and the sixth saving module 407, and is configured to be based on the first saving module. 401. The second save module 402, the third save module 403, the fourth save module 405, the fifth save module 406, and the sixth save module 407 search, compare, and analyze the acquired and/or saved content. The acquired and/or saved content and analysis results are included in the database forensics report.

The working principle of the device shown in Fig. 6a or Fig. 6b is shown in Fig. 2, and details are not described herein again.

According to the apparatus shown in FIG. 6a or FIG. 6b, on the basis of FIG. 4 or FIG. 5, it is also possible to separately check and save the target database, the blank result database, and the acquired records that meet the set conditions. The check value is used to seal the original attribute and the original content of the target database and the result database in the application scenario of the electronic data forensics, and can be used as a basis for checking the target database and the acquired content, and as an electronic data forensics. Evidence from the letter, the show and the shield.

Example 7

The embodiment of the invention further provides a database forensic device, as shown in FIG. 7a, FIG. 7b, FIG. 7c or FIG. 7d, The device is based on the device shown in Figure 4, Figure 5, Figure 6a or Figure 6b, the device further comprising:

The seventh saving module 409 is connected to the target database and the analysis processing module 407, or is connected to the interface module 404 and the analysis processing module 407, for acquiring and saving user information and log information of the target database; and acquiring the user information and the log. The information is separately verified to obtain the check value of the user information and the check value of the log information, and the check value of the user information and the check value of the log information are saved; wherein, the log information is at least one or a combination of the following: , operation log, SQL log, import and export log, backup log, error log, and alarm log. Then, the analysis processing module 407 also analyzes the content saved by the seventh saving module 408.

The working principle of the device shown in Fig. 7a, Fig. 7b, Fig. 7c or Fig. 7d is shown in Fig. 3, and details are not described herein again.

The device information and the log information of the target database can also be saved and verified by the device shown in FIG. 7a, FIG. 7b, FIG. 7c or FIG. 7d, and can also be used as a basis for checking the user information and the log information, so that Subsequent analysis or verification of user information and log information, as well as evidence of e-mail, presentation and shield evidence in electronic data forensics.

Example eight

The embodiment of the present invention further provides a database forensic device, as shown in FIG. 8a or FIG. 8b, the device is based on the device shown in FIG. 4 or FIG.

The storage control module 410 is connected to the first saving module 401, the second saving module 402, and the third saving module 403, for controlling the first saving module 401, the second saving module 402, and the plurality of target databases. The / third save module 403 centrally stores the content to be saved for each target database in a predetermined database type.

The working principle of the device shown in Fig. 8a or Fig. 8b is the same as that in the fourth embodiment, and will not be described again here. By means of the apparatus shown in Fig. 8a or Fig. 8b, it is also possible to reduce the cumbersome operation of copying a plurality of target databases and improve the operation efficiency.

Example nine

The embodiment of the present invention further provides a database forensic device, as shown in FIG. 9a or FIG. 9b. On the basis of the device shown in FIG. 6a or FIG. 6b, the device further includes:

The storage control module 410 is connected to the first saving module 401, the second saving module 402, the third saving module 403, the fourth saving module 405, and the fifth saving module 406, and is configured to control when there are multiple target databases. The first save module 401, the second save module 402, the third save module 403, the fourth save module 405, the fifth save module 406, and the sixth save module 407 are saved in a predetermined database type for each target database. Saved content.

The working principle of the device shown in Fig. 9a or Fig. 9b is the same as that in the fourth embodiment, and will not be described again here. The apparatus shown in Fig. 9a or Fig. 9b can also reduce the cumbersome operation of copying multiple target databases and improve the operation efficiency.

Example ten The embodiment of the present invention further provides a database forensic device, as shown in FIG. 10a, FIG. 10b, FIG. 10c or FIG. 10d. The device further includes the device shown in FIG. 7a, FIG. 7b, FIG. 7c or FIG. 7d. :

The storage control module 410 is connected to the first saving module 401, the second saving module 402, the third saving module 403, the fourth saving module 405, the fifth saving module 406, the sixth saving module 407, and the seventh saving module 408, In the case of having a plurality of target databases, the first saving module 401, the second saving module 402, the third saving module 403, the fourth saving module 405, the fifth saving module 406, the sixth saving module 407, and the seventh are controlled. The save module 408 centrally stores the content to be saved for each target database in a predetermined database type.

The operation of the apparatus shown in Fig. 10a, Fig. 10b, Fig. 10c or Fig. 10d is the same as that in the fourth embodiment, and will not be described again here.

By means of the apparatus shown in 10a, 10b, 10c or 10d, it is also possible to reduce the cumbersome operation of copying a plurality of target databases and improve the operation efficiency.

A person skilled in the art can understand that all or part of the steps carried by the method of the foregoing embodiment can be completed by a program to instruct related hardware, and the program can be stored in a computer readable storage medium, and the program is executed. Including one or a combination of the steps of the method embodiments.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. The integrated modules, if implemented in the form of software functional modules and sold or used as stand-alone products, may also be stored in a computer readable storage medium.

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the present invention is in the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) in which computer usable program code is embodied.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each process and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory include instructions. The manufacturing device, the instruction device implements the functions specified in one or more blocks of a flow or a flow and/or a block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and modifications of the invention

Claims

Rights request

1. A database evidence collection method, characterized by including:

According to the database structure of the target database and the table structure of each table included in the target database, establish and save a blank result database that has a consistent structure with the target database but does not contain specific data entries;

Verify each record in each table in the target database to obtain the verification value, and save the verification value of each record in the target database;

Obtain records that meet the set conditions in the target database and save the obtained records.

2. The method according to claim 1, characterized in that, the method further includes:

Verify the target database to obtain the verification value of the target database, verify each table included in the target database to obtain the verification value of each table; save the verification value of the target database and the verification values of each table of the target database; Verify the blank result database to obtain the verification value of the result database. Verify each table included in the result database to obtain the verification value of each table. Save the verification value of the result database and the verification value of each table of the result database. test value.

3. The method according to claim 1, characterized in that, each record in each table in the target database is verified to obtain a verification value, and saving the verification value of each record in the target database specifically includes:

Verify the primary key of each record and the record content of each record in the target database respectively, and obtain the primary key verification value and record content verification value of each record;

Save the primary key check value and record content check value of each record in the target database, and save the corresponding relationship between the primary key check value and record content check value of each record.

4. The method according to claim 1, characterized in that, after obtaining the records in the target database that meet the set conditions, the method further includes:

Verify the obtained records to obtain the verification values of the records that meet the set conditions, and save the verification values of the obtained records that meet the set conditions.

5. The method according to claim 1, characterized in that, the method further includes:

Obtain and save the user information and log information of the target database; wherein, the log information is at least one or a combination of the following: login log, operation log, SQL log, import and export log, backup log, error log, alarm log; for the obtained The user information and the log information are verified respectively to obtain the verification value of the user information and the verification value of the log information, and the verification value of the user information and the verification value of the log information are saved.

6. The method according to any one of claims 1 to 5, characterized in that, the method further includes: in the case of multiple target databases, centrally saving the data for each target database in a predetermined database type. What needs to be saved.

7. A database evidence collection device, characterized by including:

The first saving module is used to save data according to the database structure of the target database and the tables of each table included in the target database. Structure, create and save a blank result database with the same structure as the target database;

The second saving module is used to verify each record of each table in the target database to obtain the verification value, and save the verification value of each record in the target database;

The third saving module obtains records in the target database that meet the set conditions and saves the obtained records.

8. The device according to claim 7, characterized in that, the device further includes:

The fourth saving module is used to verify the target database to obtain the verification value of the target database, verify each table included in the target database to obtain the verification value of each table; save the verification value of the target database and the verification value of the target database. Check value of each table;

The fifth saving module is used to verify the result database to obtain the verification value of the result database, verify each table included in the blank result database to obtain the verification value of each table; save the verification value and results of the result database Check values of each table in the database.

9. The device according to claim 7, characterized in that the second saving module is specifically used to: verify the primary key of each record and the record content of each record in the target database, and obtain each The primary key verification value and record content verification value of the record;

10. The device according to claim 7, characterized in that, the device further includes:

The sixth saving module is used to verify the records obtained by the third saving module to obtain the verification values of the records that meet the set conditions, and save the obtained verification values of the records that meet the set conditions;

The seventh saving module is used to obtain and save user information and log information of the target database; wherein, the log information is at least one or a combination of the following: login log, operation log, SQL log, import and export log, backup log, error log , Alarm log; Verify the obtained user information and log information respectively to obtain the verification value of the user information and the verification value of the log information, and save the verification value of the user information and the verification value of the log information;

A storage control module, configured to control the first saving module, the second saving module and the third saving module to centrally save each target database in a predetermined database type when there are multiple target databases. What needs to be saved.