Tampering of database can be determined through cryptographically hash functions. Hash functions determines only the tampering of data but forensic analysis functions determines only the tampering of data but forensic analysis can help to detect when data is tampered, what data is tampered and ultimately who and why. This paper presents a forensic analysis algorithm which is more efficient than forensic algorithms. It provides a solution set (all possible location of detected tampering.) and provides complete features of the solution set and its cardinality