[New Tool] DataWalker for Oracle v1.0 in the wild

DataWalker for Oracle is a data unloader and block examiner tool. It can be used by DBAs to recover data or by forensic examiners to look for evidence after a breach.

Figure 1 – the DataWalker interface

This document describes how to recover data from a given table.

Recovering data using DataWalker

For the purposes of this exercise, we’ll dump a list of object IDs and object names from the SYS.OBJ$ table from the data file that contains the SYSTEM tablespace. To start, click on the “Folder” icon on the toolbar and select the data file. Once selected you’ll be presented with a “Load Options” window:

If you don’t want to examine any data blocks simply select, “No load, just open”. This is the quickest option. Then choose “Data” from the menu and select “Export”. You’ll be presented with the “Export Data” form. This form requires three pieces of information: an export template, an output file and the object ID of the table you wish to dump the data from.

[button size=large style=round color=red align=none url=http://www.databaseforensics.com/datawalker_for_oracle.htm ]Read more and Download [/button]

Tool submitted by the respected David Litchfield.