Method of Recovery of Deleted Records in a Postgre SQL Database

As more and more information is being handled in enterprise IT environments, database utility has been increasing accordingly. With the increased use of databases, there is a high possibility that database records will need to be utilized as evidence, as in the case of IT-related crimes. There has been a growing need for the recovery of both maliciously deleted and ordinarily deleted records in order to use database records as legal evidence. Research on the methods of record restoration has only been carried out in regard to certain Database Management Systems (DBMS) [1], [2], [3], [4]. However, even though it is open source, research on the record restoration method for PostgreSQL has not been performed. This paper recommends recovery methods for records deleted from PostgreSQL. When recovering deleted records, PostgreSQL data files, which contain a history of deleted records, are required. Also, a Hex editor is used, which is able to check the contents of data files. One can analyze each record’s header information by opening PostgreSQL data files with a Hex editor. Then, the analyzed header information from the records is checked. If it is deemed that there are deleted records, they can be extracted for recovery. If VACUUM, which is a record cleanup program offered by PostgreSQL, has been used for deletion, the records cannot be restored. In this study, it was possible to recover the deleted records of the PostgreSQL database in the damages caused by cybercrime. Recovered records can be used as legal evidence, which can be beneficial to companies in court situation. The benefit of being in a court situation helps protect the interests of the enterprise.