This paper is the final in a series of papers exploring Oracle forensics by David Litchfield.
In this paper David will be examining the internals of the Oracle System Change Number (SCN) in 10g and show how it can be useful in forensic investigations.
The paper will also show how orablock and oratime can be used to discover when an Oracle data block was changed.
