David Litchfield’s part 7 in his series on Oracle Forensics is called “Using the Oracle system change number in forensic examinations”.

The paper demonstrates two tools. The first tool is “oratime”, which maps SCNs to timestamps using raw block data. The second tool is “orablock”, which dumps data from blocks including deleted data.

Unlike BBED (provided by Oracle) orablock is read only and the source code is available.