Definición de un marco de trabajo para la ejecución de un análisis forense orientado a servidores base de datos SQL server para el manejo de incidentes de una empresa de seguros en el Ecuador

Abstract

Abstract: This thesis aims to explore the field of computer forensics, specifically focusing on Windows servers and SQL databases, with the goal of studying the procedures and methodologies necessary to establish a framework for conducting such forensics in the event of a computer incident. The proposed framework is based on international best practices, internationally recognized standards such as NIST and ISO 27037, and widely accepted forensic analysis models such as SANS, ISO 27037, NIST 800-62, DFRWS, and FBI. The proposed framework addresses all the phases required to perform a forensic analysis, which are: Identification, preservation, collection/acquisition, examination/analysis, and presentation. This document also includes technical procedures for the collection and forensic analysis of servers and databases, addressing critical aspects such as volatile memory capture, hard drive imaging, log analysis, event correlation, and more. This work aims to provide a practical guide for cybersecurity professionals, forensic analysts, and businesses in general, helping them strengthen their capabilities to identify and manage security incidents.