Cached information may also exist in a servers RAM requiring live analysis techniques.
Alternatively, a forensic examination may focus on identifying transactions within a database system or application that indicate evidence of wrongdoing, such as fraud.
[4] Additionally there is a subsequent SQL Server Forensics book by Kevvie Fowler which is also well regarded.
[5] The forensic study of relational databases requires a knowledge of the standard used to encode data on the computer disk.
A documentation of standards used to encode information in well-known brands of DB such as SQL Server and Oracle has been contributed to the public domain.