David Litchfield posted several new papers on Oracle forensics last week.
Oracle Forensics Part 1: Dissecting the Redo Logs
Oracle Forensics Part 2: Locating Dropped Objects
Oracle Forensics Part 3: Isolating Evidence of Attacks Against the Authentication Mechanism
Check them out.
[tags]Oracle, Database Forensics, David Litchfield[/tags]