CHFI Database Forensics 3

Question 1

Which SQL Server feature, when enabled, records all login attempts including failed ones, and is critical for forensic investigations?

Accepted Answer

SQL Server Audit

Answer

SQL Server Audit tracks and logs SQL Server and database-level events including successful and failed login attempts, providing a forensic audit trail.

Question 2

In database forensics, what information can be extracted from the MySQL ibdata1 file?

Accepted Answer

InnoDB tablespace data including deleted records not yet purged

Answer

The ibdata1 file is the InnoDB shared tablespace and contains table data, indexes, and potentially deleted records that have not yet been purged by InnoDB's background purge process.

Question 3

What forensic technique involves comparing database schema versions to identify unauthorized structural changes?

Accepted Answer

Schema diffing

Answer

Schema diffing compares two versions of a database schema to detect unauthorized additions, modifications, or deletions of tables, columns, or stored procedures.

Question 4

Which CHFI-relevant tool is specifically designed to recover and analyze SQLite database files commonly found on mobile devices and applications?

Accepted Answer

DB Browser for SQLite

Answer

DB Browser for SQLite allows forensic investigators to open, view, and recover data from SQLite database files, which are widely used in mobile apps and desktop applications.

Question 5

During a forensic investigation, an analyst discovers that SQL Server error log entries have been deleted. Where else might evidence of malicious database activity be found?

Accepted Answer

Windows Event Logs and SQL Server transaction logs

Answer

Windows Event Logs record SQL Server service events and security events, while transaction logs record all data modifications, providing corroborating evidence even when error logs are deleted.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Database Forensics 3