A database system configured such that at least part of the database system is configured to be executed within a trusted execution environment, the database system comprising: a transaction logger configured to write transaction log entries to a transaction log stored outside of the trusted execution environment, each of the transaction log entries comprising a transaction processed by the database system and a counter value; a first secure counter configured to generate the counter value stored outside of the trusted execution environment, the counter value comprising a representation of the number of transaction log entries which have been written to the transaction log for transactions which have been committed to the database; a restoration module configured to restore the database system based, at least in part, on transaction log entries retrieved from the transaction log and a current value of the first secure counter; a second secure counter configured to maintain a representation of the number of transaction log entries which have been truncated by the log truncation module; a third secure counter configured to maintain a representation of the number of transaction log entries which have been written to the transaction log; and a fourth secure counter configured to be incremented during restoration of the database system by the restoration module at least when a value of the third secure counter at the time of restoration is greater than a value of the first counter at the time of restoration, wherein the restoration module is further configured to restore the database system based additionally on a current value of the fourth secure counter and the respective values of the fourth secure counter indicated by each of the transaction log entries. a transaction logger configured to write transaction log entries to a transaction log stored outside of the trusted execution environment, each of the transaction log entries comprising a transaction processed by the database system and a counter value; a first secure counter configured to generate the counter value stored outside of the trusted execution environment, the counter value comprising a representation of the number of transaction log entries which have been written to the transaction log for transactions which have been committed to the database; a restoration module configured to restore the database system based, at least in part, on transaction log entries retrieved from the transaction log and a current value of the first secure counter; a second secure counter configured to maintain a representation of the number of transaction log entries which have been truncated by the log truncation module; a third secure counter configured to maintain a representation of the number of transaction log entries which have been written to the transaction log; and a fourth secure counter configured to be incremented during restoration of the database system by the restoration module at least when a value of the third secure counter at the time of restoration is greater than a value of the first counter at the time of restoration, wherein the restoration module is further configured to restore the database system based additionally on a current value of the fourth secure counter and the respective values of the fourth secure counter indicated by each of the transaction log entries.