FactumDB — MySQL Forensic Correlation Tool
OngoingThe Challenge
Investigating a compromised or disputed database means reconstructing what actually happened at the storage layer — but the raw forensic tools each emit their own ad-hoc output format, and InnoDB tablespace files aren't designed to be correlated with binary logs.
My Approach
I built the utility adapter layer wrapping ibd2sdi, innochecksum, ibd2sql, and mysqlbinlog, parsing their raw output into canonical models — including positional-field-to-schema mapping and table-level filtering for multi-table binary logs. I also designed and implemented the SQLite persistence layer covering schemas, physical records, binlog events, and utility-execution provenance, with normalized test fixtures validating each adapter.
Current Status
Still in active development. The adapter and persistence layers are implemented and test-covered, turning inconsistent forensic tool output into a queryable, provenance-tracked store.