David Litchfield has published multiple papers on Oracle Database Forensics. From his site
"Since the state of California passed the Database Security Breach
Notification Act (SB 1386) in 2003 another 34 states have passed
similar legislation with more set to follow.
In January 2007 TJX announced they had suffered a database
security breach with 45.6 million credits card details stolen – the
largest known breach so far.
In 2006 there were 335 publicized breaches in the U.S.; in
2005 there were 116 publicized breaches; between 1st January and March
31st of 2007, a 90 day period, there have been 85 breaches publicized.
Never has Oracle forensics and incident response been so
important. These papers should help forensic examiners and incident
responders to find evidence after a database intrusion has occured. "
Paper Link: http://www.databasesecurity.com/oracle-forensics.htm
