David Litchfield has published multiple papers on Oracle Database Forensics. From his site

"Since the state of California passed the Database Security Breach Notification Act (SB 1386) in 2003 another 34 states have passed similar legislation with more set to follow.

In January 2007 TJX announced they had suffered a database security breach with 45.6 million credits card details stolen – the largest known breach so far.

In 2006 there were 335 publicized breaches in the U.S.; in 2005 there were 116 publicized breaches; between 1st January and March 31st of 2007, a 90 day period, there have been 85 breaches publicized.

Never has Oracle forensics and incident response been so important. These papers should help forensic examiners and incident responders to find evidence after a database intrusion has occured. "

Paper Link: http://www.databasesecurity.com/oracle-forensics.htm