Pete Finnigan's Oracle Security Weblog

I just saw Ben Rumings blog post on http://www.orablogs.com - (broken link) orablogs titled http://www.orablogs.com/realworld/archives/000977.html - (broken link) A Flashback Database that i found interesting. Ben had been on a two day course in Australia given by Oracle with Howard Rogers as the instructor. In the course Howard talked about Flashback which is why I was interested in Bens post. Flashback, although limited in how long you have to look at the historic data due to sizing is a great idea. I am interested from a forensics point of view.

Forensics investigation of Oracle databases is something that I get asked to do from time to time by clients of mine to look at why something happened or when or who did something. The usual methods involve looking at logs, archivelogs, redo and other tell tale factors in the data dictionary to try and find out what happened and when and possibly by who. Flashback is a useful addition to the Oracle forensics toolkit as well as all of its other uses. Ben includes some simple examples in his post. Howard has also talked about Flashback in posts on his site titled "Alternatives to Point-in-Time Recovery", "New Features in Oracle 10g" and "Data Pump". Anyway Bens post provides food for thought.