CHFI Database Forensics 1 — Questions and Answers
Question 1: Which SQL Server system database stores metadata about all other databases on the SQL Server instance?
- tempdb
- model
- master (Correct answer)
- msdb
Correct answer: master
The master database stores all instance-level metadata including login accounts, endpoints, linked servers, and configuration settings.
Question 2: In database forensics, which log file type records every transaction and database modification for SQL Server?
- Error log
- Transaction log (.ldf) (Correct answer)
- Audit log
- Event log
Correct answer: Transaction log (.ldf)
The SQL Server transaction log (.ldf) records all transactions and database modifications, making it critical for forensic timeline reconstruction.
Question 3: What tool can a CHFI investigator use to read and analyze MySQL binary logs during a database forensic investigation?
- mysqlcheck
- mysqlbinlog (Correct answer)
- mysqldump
- mysql_upgrade
Correct answer: mysqlbinlog
The mysqlbinlog utility reads MySQL binary log files, allowing investigators to reconstruct all SQL statements executed on the server.
Question 4: During a database forensics investigation, an investigator finds rows in a SQL Server table with no matching audit records. What should be checked first?
- Firewall logs
- The transaction log for direct inserts (Correct answer)
- DNS logs
- Application event logs
Correct answer: The transaction log for direct inserts
Direct inserts bypassing the application layer appear in the transaction log even if application-level audit triggers did not fire.
Question 5: Which Oracle database view provides information about all currently connected sessions and can help identify unauthorized access?
- V$DATAFILE
- V$SESSION (Correct answer)
- DBA_TABLES
- ALL_OBJECTS
Correct answer: V$SESSION
V$SESSION is a dynamic performance view in Oracle that displays information about all current database sessions including username, logon time, and program.
Question 6: What is the primary forensic value of the SQL Server msdb database?
- Stores user data tables
- Contains SQL Agent job history and backup/restore history (Correct answer)
- Holds temporary objects
- Stores model database templates
Correct answer: Contains SQL Agent job history and backup/restore history
The msdb database stores SQL Server Agent job history, backup and restore history, and Database Mail data, providing a timeline of automated activities.
CHFI Database Forensics 1
Which SQL Server system database stores metadata about all other databases on the SQL Server instance?