Dark Web, MySQL and Cloud Forensics

What it is

This page covers three environments where evidence is found in unusual places: the dark web, a MySQL database server and the cloud. Each has its own architecture, its own evidence sources and its own legal and practical limits.

How it works

The dark web

The internet is often described in three layers. The surface web is indexed by search engines. The deep web is content not indexed, such as banking portals, email and databases behind a login. The dark web is a part of the deep web reachable only with special software such as TOR, using onion addresses. It is used for privacy and also for illegal markets, so investigators meet it in cases of drugs, stolen data, fraud and malware trade.

TOR relays and bridge nodes

TOR (The Onion Router) sends traffic through a chain of volunteer relays, each knowing only its neighbors.

Bridges are not published in the main relay list, so a network cannot easily block them.

How the TOR Browser works

The TOR Browser builds a circuit of three relays. The client wraps the data in layers of encryption, one for each relay. Each relay removes only its own layer and forwards the rest, so no single relay knows both the source and the destination. Onion services (addresses ending in .onion) are reached through rendezvous points, so the server's location is also hidden. The browser is configured to resist tracking and keeps little history.

Risks of investigating the dark web

• Exposure of the investigator's identity if safeguards fail.
• Malware, exploits and tracking in hostile sites.
• Illegal content that may be unlawful to access or store without authority.
• Legal limits, since undercover work and entrapment rules differ by country.

Precautions: use an isolated, dedicated machine, authorized accounts, no personal identity, full documentation and legal guidance.

Internal architecture of MySQL

MySQL is a relational database server with layers:

• Connection layer: handles client connections, authentication and threads.
• SQL layer: parses and optimizes queries, with caches and the permissions system.
• Storage engine layer: stores and retrieves data. Common engines are InnoDB (the default, transactional) and MyISAM (older, non transactional).
• File system: the data files and logs on disk.

Structure of the data directory

The data directory (commonly /var/lib/mysql on Linux) holds the evidence.

Types of cloud computing services

Cloud deployment models

Public clouds are shared and run by a provider. Private clouds serve one organization. Community clouds are shared by organizations with common needs. Hybrid clouds combine two or more models. The more control the customer has over the platform, the more evidence it can collect itself.

Cloud computing threats and attacks

Cloud forensics is hard because data is spread across regions, the customer shares control with the provider, and logs may be kept only for a limited time.

AWS and Google Cloud fundamentals

A snapshot of a virtual disk is the cloud equivalent of a disk image, and the audit log shows who did what through the control interfaces.

A worked example

A storage bucket holding customer data was read from an unknown address. The investigator exports the audit log for the bucket, preserves it with a hash, snapshots the virtual machine that used the bucket's credentials, and requests the provider's retention records if legal authority exists.

How the exam asks about this

• "Which TOR node is an unlisted entry point used in censored networks?" → A bridge.
• "Which MySQL file type stores InnoDB shared tablespace data?" → ibdata1.
• "Which cloud model gives the customer the most control over the operating system?" → IaaS.