Jonathan Grier
15 Papers
80 Citations
Jonathan Grier is an academic researcher. The author has contributed to research in topics: Database storage structures & Database forensics. The author has an hindex of 7, co-authored 15 publications.
Chat about Author
Papers
Database forensic analysis through internal structure carving
TL;DR: This paper presents a universal tool that seamlessly supports many different databases, rebuilding table and other data content from any remaining storage fragments on disk or in memory, and empirically verify the tool's ability to recover both deleted and partially corrupted data directly from the internal storage of different databases.
56
Rapid forensic imaging of large disks with sifting collectors
Jonathan Grier,Golden G. Richard +1 more
TL;DR: Sifting collectors challenge many conventional notions about forensic acquisition and may help tame the volume challenge by enabling examiners to rapidly acquire and easily store large disks without sacrificing the many benefits of imaging.
34
Carving database storage to detect and trace security breaches
James Wagner,Alexander Rasin,Boris Glavic,Karen Heart,Jacob D. Furst,Lucas Bressan,Jonathan Grier +6 more
TL;DR: This work presents an approach that evaluates the integrity of a live database, identifying and reporting evidence for log tampering, based on forensic analysis of database storage and detection of inconsistencies between database logs and physical storage state (disk and RAM).
32
Detecting data theft using stochastic forensics
TL;DR: A method to examine a filesystem and determine if and when files were copied from it is presented, by stochastically modeling filesystem behavior under both routine activity and copying and identifying emergent patterns in MAC timestamps unique to copying.
30
•Proceedings Article
Database Forensic Analysis with DBCarver
James Wagner,Alexander Rasin,Tanu Malik,Karen Heart,Hugo Jehle,Jonathan Grier +5 more
- 01 Jan 2017
TL;DR: This paper presents DBCarver, a tool for reconstructing database content from a database image without using any log or system metadata, and describes how the two kinds of data can be combined to enable a variety of forensic analysis questions hitherto unavailable to forensic investigators.