Data breach source and timeline analysis

A computer program product for analyzing a potential data breach, the computer program product comprising a non-transitory computer-readable storage medium having computer-usable program code embodied therein, the computer-usable program code configured to perform the following when executed by at least one processor:

• identify a time frame and data store in which a data breach potentially occurred;
• reconstruct the data store to a point in time near an end of the time frame;
• repeatedly perform the following until the data store reaches a point in time near a beginning of the time frame:
• revert to a previous version of the data store by removing an incremental update to the data store;
• record changes to the data store caused by removing the incremental update;
• and
• record timestamps associated with the changes;
• create a report that documents the changes and the timestamps;
• and
• confirm that the changes in the report are legitimate by comparing the changes against a recovery log.

A system for analyzing data corruption, the system comprising:

• at least one processor;
• at least one memory device operably coupled to the at least one processor and storing instructions for execution on the at least one processor, the instructions causing the at least one processor to:
• identify a time frame and data store in which a data breach potentially occurred;
• reconstruct the data store to a point in time near an end of the time frame;
• repeatedly perform the following until the data store reaches a point in time near a beginning of the time frame:
• revert to a previous version of the data store by removing an incremental update to the data store;
• record changes to the data store caused by removing the incremental update;
• and
• record timestamps associated with the changes;
• create a report that documents the changes and the timestamps;
• and
• confirm that the changes in the report are legitimate by comparing the changes against a recovery log.