Analysis of the Internals of MySQL/InnoDB B+ Tree Index Navigation from a Forensic Perspective

In this paper we analyze the structure and generation of InnoDB-indices, as well as navigation in this internal structures with respect to its application in digital forensics. We thus provide an overview on the internal workings of the index that can be used to detect manipulations on the underlying table space. We analyze the physical as well as the logical structure of the index pages and its relation to the very theoretical field of B+-tree forensics. There we provide a first usable forensic technique targeting a real life open source database system. Furthermore, we discuss several use cases in the course of forensic investigations, as well as applications of the outlined methods, including possible extensions to the field of file system forensics.