Litchfield described where forensic evidence can be found within a compromised database:

An attacker may go around creating objects and then go and attempt to clean up and hide evidence," Litchfield said.

But often, hidden deep within an Oracle data block, hackers leave traces of their past presence. The header and row directory in a data block correspond to areas within a database that can yield revealing clues, Litchfield said.

He also warned against other tools that can change system data:

"There are tools that allow you to fudge your way through, but by running them you can change a system in a drastic way."

The sticking point for Litchfield is that it uses Oracle proprietary algorithms. Litchfield hasn't focused on making friends at Oracle over the years and his past efforts to expose security vulnerabilities in the top selling RDBMS probably hasn't left Oracle inclined to work with Litchfield on this. That would be a loss of all of us.

We need tools like this and the best of them are going to use detailed knowledge of database algorithms and data structures, just like the best attackers. Oracle shouldn't block this one, for its customer's sake.