CHFI Database Forensics 2

Question 1

Which technique allows a forensic investigator to recover deleted rows from a SQL Server database without a backup?

Accepted Answer

Log file analysis using transaction log parser

Answer

Deleted rows remain in the transaction log until the log is truncated, allowing forensic tools like ApexSQL Log to reconstruct and recover deleted data.

Question 2

In a PostgreSQL forensic investigation, which directory contains the server log files by default?

Accepted Answer

$PGDATA/log

Answer

PostgreSQL writes server log files to the $PGDATA/log directory by default, recording connections, errors, and optionally all SQL statements.

Question 3

What does the term 'database carving' refer to in forensic investigations?

Accepted Answer

Recovering database records from raw disk images without a live database

Answer

Database carving involves extracting database records and structures directly from raw disk images or unallocated space when the database system is unavailable.

Question 4

Which Oracle audit trail type stores audit records in OS files rather than within the database itself?

Accepted Answer

OS audit trail

Answer

The OS audit trail writes audit records to the operating system audit log, making them harder for a compromised DBA to tamper with.

Question 5

A forensic investigator needs to determine when a specific stored procedure was last modified in SQL Server. Which catalog view should they query?

Accepted Answer

sys.objects

Answer

The sys.objects catalog view contains a modify_date column that records the last modification timestamp for all database objects including stored procedures.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Database Forensics 2