Database, Tor Browser, Dark Web and Email Forensics

What it is

This page joins three areas that often meet in one case: the database behind a website, anonymized browsing with Tor and email as the crime vehicle. Memory is the common thread, because Tor leaves little on disk.

You need to know where each system keeps evidence, how memory is collected and searched, and the standard steps of an email investigation.

How it works

Database forensics with SQL Server Management Studio and ApexSQL DBA

SQL Server keeps data in .mdf and .ndf files and the transaction log in .ldf. The log records changes and is the main source for what was changed and when.

SQL Server Management Studio (SSMS) is the Microsoft client for viewing the instance. An investigator uses it to read Management > SQL Server Logs (the error log, which records Login failed for user messages), review logins and permissions, and check running sessions. Volatile views include sys.dm_exec_sessions, sys.dm_exec_connections and sys.dm_exec_requests, and DBCC OPENTRAN shows open transactions. Collect volatile data first, then work from a snapshot, a backup or a stopped copy of the data and log files rather than the live files. ApexSQL DBA is a third party SQL Server tool named in the outline. Product availability and features have changed over time, so check what the version in use offers and rely on the native logs for the core evidence.

MySQL forensics for a WordPress site

A WordPress site stores configuration in wp-config.php, which holds the database name, user, password and host. Tables use a prefix, usually wp_.

Example query: SELECT ID, user_login, user_registered FROM wp_users ORDER BY user_registered DESC;. MySQL logs include the error log, general query log, slow query log and binary log (read with mysqlbinlog). The data directory is commonly /var/lib/mysql. Compare the web server access log with the database changes to find the entry point.

Tor Browser memory acquisition

Tor Browser routes traffic through the Tor network and keeps no browsing history by default. While it is open, memory holds page text, URLs, form data and webmail content. Closing the browser or rebooting loses most of it.

Acquire memory while the browser is still open, then acquire the disk. The Tor Browser uses SOCKS port 9150 on localhost, and the Tor daemon itself uses 9050.

Collecting memory dumps

Run the tool from external media, write the dump to a different drive, record the time and the tool used, and hash the dump. Volatile data goes first in the order of volatility.

Memory dump analysis with Bulk Extractor

Bulk Extractor scans raw data without using the file system and pulls out features: email addresses, URLs, domains, credit card numbers, phone numbers and more. It works well on memory dumps, unallocated space and whole images. Example: bulk_extractor -o output_dir memory.dmp.

Output files such as email.txt, url.txt and domain.txt list each feature with its offset, and histogram files count how often each appears.

Email artifacts in memory and storage (Tor open and closed)

Search memory with Bulk Extractor or string searches for addresses and message text. In storage, check the download folder, recent file shortcuts and the file system times of attachments.

Forensic analysis of an uninstalled Tor Browser

Tor Browser is a portable application, and deleting its folder leaves traces elsewhere:

• Prefetch files for the Tor Browser executables.
• UserAssist and other registry execution records.
• Shortcut and Jump List entries and the $MFT and USN journal entries for deleted files.
• Carvable fragments in unallocated space and the pagefile.
• Network records showing Tor entry points or the ports above.

Dark web forensics challenges

Onion routing wraps traffic in several layers of encryption across relays, so no single node knows both source and destination. Hidden services have .onion addresses and move or vanish. Payments often use cryptocurrency.

Challenges are anonymity, a lack of central logs, volatile sites, cross border law and encrypted content. Investigators usually rely on endpoint evidence from the suspect's device, undercover work and legal process, not on tracing the Tor circuit.

Steps to investigate email crimes

1. Get authorization and secure the evidence, including the device and the account.
2. Acquire the mailbox: client files (PST or OST for Outlook, MBOX, EML), server copies and backups.
3. Examine the full headers. Read the Received lines from bottom to top. Check From, Reply-To, Message-ID and the SPF, DKIM and DMARC results.
4. Trace the originating IP address with WHOIS and server logs.
5. Examine attachments, links and linked accounts. Hash everything.
6. Correlate with server, proxy and firewall logs, then report.

A worked example

A WordPress site shows spam links. The error log is clean, but wp_users holds an admin created at 02:14 and wp_options lists a plugin nobody installed. The access log shows a POST to a vulnerable plugin at 02:11 from one address.

The investigator copies the database, hashes it and links the plugin request to the new account. The same address is checked against the SSH and FTP logs for other access.

How the exam asks about this

• "Which tool scans raw data for emails and URLs without using the file system?" -> Bulk Extractor.
• "In which order should you read the Received headers to trace an email's path?" -> Bottom to top.
• "Which WordPress file contains the database credentials?" -> wp-config.php.