Abstract: In the field of forensic analysis of databases, a method of performing database rollback to a previous state of a database using a write-ahead log (WAL) includes: selecting, in the set of frames recorded to the WAL, a specific frame representing a specific revised content of a corresponding specific page; identifying, in the set of frames, a first subset of frames containing the specific frame and zero or more thereto chronologically preceding frames; extracting, from the set of pages of the database, a first subset of pages; extracting, from the corresponding pages of the first subset of frames, a second subset of pages; and performing, based on the contents of the first subset of pages and the revised contents of the second subset of pages, a rollback of the database to a previous state containing the revised content of the specific page.

Abstract: In the field of forensic analysis of databases, a method of performing database rollback to a previous state of a database using a write-ahead log (WAL) includes: selecting, in the set of frames recorded to the WAL, a specific frame representing a specific revised content of a corresponding specific page; identifying, in the set of frames, a first subset of frames containing the specific frame and zero or more thereto chronologically preceding frames; extracting, from the set of pages of the database, a first subset of pages; extracting, from the corresponding pages of the first subset of frames, a second subset of pages; and performing, based on the contents of the first subset of pages and the revised contents of the second subset of pages, a rollback of the database to a previous state containing the revised content of the specific page.

Abstract: In the field of forensic analysis of databases, a method of performing database rollback to a previous state of a database using a write-ahead log (WAL) includes: selecting, in the set of frames recorded to the WAL, a specific frame representing a specific revised content of a corresponding specific page; identifying, in the set of frames, a first subset of frames containing the specific frame and zero or more thereto chronologically preceding frames; extracting, from the set of pages of the database, a first subset of pages; extracting, from the corresponding pages of the first subset of frames, a second subset of pages; and performing, based on the contents of the first subset of pages and the revised contents of the second subset of pages, a rollback of the database to a previous state containing the revised content of the specific page.