CHFI Database Forensics 2

Question 1

Which technique allows a forensic investigator to recover deleted rows from a SQL Server database without a backup?

Accepted Answer

Log file analysis using transaction log parser

Answer

Index scan

Answer

Full-text search

Answer

Schema comparison

Question 2

In a PostgreSQL forensic investigation, which directory contains the server log files by default?

Accepted Answer

$PGDATA/log

Answer

$PGDATA/pg_wal

Answer

$PGDATA/pg_stat

Answer

$PGDATA/global

Question 3

What does the term 'database carving' refer to in forensic investigations?

Accepted Answer

Recovering database records from raw disk images without a live database

Answer

Partitioning a database for performance

Answer

Encrypting database columns

Answer

Splitting a database across multiple servers

Question 4

Which Oracle audit trail type stores audit records in OS files rather than within the database itself?

Accepted Answer

OS audit trail

Answer

Database audit trail

Answer

Fine-grained auditing

Answer

Unified auditing

Question 5

A forensic investigator needs to determine when a specific stored procedure was last modified in SQL Server. Which catalog view should they query?

Accepted Answer

sys.objects

Answer

sys.indexes

Answer

sys.partitions

Answer

sys.columns

Question 6

What type of attack involves inserting malicious SQL code into a query to extract or manipulate database data, and is commonly investigated in CHFI database forensics?

Accepted Answer

SQL injection

Answer

Buffer overflow

Answer

Cross-site scripting

Answer

ARP poisoning