CHFI Database Forensics 2 — Questions and Answers
Question 1: Which technique allows a forensic investigator to recover deleted rows from a SQL Server database without a backup?
- Index scan
- Log file analysis using transaction log parser (Correct answer)
- Full-text search
- Schema comparison
Correct answer: Log file analysis using transaction log parser
Deleted rows remain in the transaction log until the log is truncated, allowing forensic tools like ApexSQL Log to reconstruct and recover deleted data.
Question 2: In a PostgreSQL forensic investigation, which directory contains the server log files by default?
- $PGDATA/pg_wal
- $PGDATA/log (Correct answer)
- $PGDATA/pg_stat
- $PGDATA/global
Correct answer: $PGDATA/log
PostgreSQL writes server log files to the $PGDATA/log directory by default, recording connections, errors, and optionally all SQL statements.
Question 3: What does the term 'database carving' refer to in forensic investigations?
- Partitioning a database for performance
- Recovering database records from raw disk images without a live database (Correct answer)
- Encrypting database columns
- Splitting a database across multiple servers
Correct answer: Recovering database records from raw disk images without a live database
Database carving involves extracting database records and structures directly from raw disk images or unallocated space when the database system is unavailable.
Question 4: Which Oracle audit trail type stores audit records in OS files rather than within the database itself?
- Database audit trail
- OS audit trail (Correct answer)
- Fine-grained auditing
- Unified auditing
Correct answer: OS audit trail
The OS audit trail writes audit records to the operating system audit log, making them harder for a compromised DBA to tamper with.
Question 5: A forensic investigator needs to determine when a specific stored procedure was last modified in SQL Server. Which catalog view should they query?
- sys.indexes
- sys.objects (Correct answer)
- sys.partitions
- sys.columns
Correct answer: sys.objects
The sys.objects catalog view contains a modify_date column that records the last modification timestamp for all database objects including stored procedures.
Question 6: What type of attack involves inserting malicious SQL code into a query to extract or manipulate database data, and is commonly investigated in CHFI database forensics?
- Buffer overflow
- SQL injection (Correct answer)
- Cross-site scripting
- ARP poisoning
Correct answer: SQL injection
SQL injection attacks insert malicious SQL statements into input fields to manipulate database queries, often leaving traces in web server logs and database logs.
CHFI Database Forensics 2
Which technique allows a forensic investigator to recover deleted rows from a SQL Server database without a backup?