CHFI Database and Application Forensics — 10 Questions

Question 1

During a database forensic investigation, an analyst discovers that multiple rows in a MySQL table have been deleted. The binary logs are enabled. Which approach should the analyst use to recover the deleted data?

Accepted Answer

Parse the binary logs using mysqlbinlog to extract the DELETE statements and reconstruct the lost data.. MySQL binary logs record all changes to the database, including DELETE statements. The mysqlbinlog utility can parse these logs to reconstruct the exact DELETE operations, allowing the analyst to reverse-engineer the deleted rows by extracting the row data from the log events. This is the standard forensic method for recovering deleted data when binary logging is enabled.

Answer

Restore the transaction log files from backup and mount them to recover the deleted rows.

Answer

Use the 'SHOW UNDO' command to retrieve the deleted rows from undo tablespace.

Answer

Query the information_schema database to retrieve deleted rows from the data dictionary.

Question 2

A forensic analyst is investigating a compromised web application that uses an Oracle database. The analyst suspects that SQL injection was used to extract sensitive data. Which Oracle log source would provide evidence of the injected SQL statements?

Accepted Answer

Listener log (listener.log). The listener.log is the correct source because Oracle's listener records all client connections and SQL*Net traffic, including the raw SQL statements sent to the database. When SQL injection is performed, the injected payload is transmitted as part of the SQL query over the network, and the listener log captures these exact statements, providing direct evidence of the attack.

Answer

Control file

Answer

Redo log files

Answer

Alert log (alert_SID.log)

Question 3

An organization uses Microsoft SQL Server 2019 with full recovery model. A database administrator accidentally executed a DROP TABLE statement. The transaction log was backed up immediately after the incident. Which forensic technique would allow the analyst to restore the dropped table?

Accepted Answer

Perform a tail-log backup, then restore the full backup and all subsequent transaction log backups, stopping before the DROP TABLE.. Option C is correct because, under the full recovery model, point-in-time recovery is required to undo the DROP TABLE. By performing a tail-log backup (to capture any transactions after the last log backup), then restoring the full backup and all subsequent transaction log backups with STOPAT or STOPBEFOREMARK to the moment just before the DROP TABLE, the analyst can recover the table without losing other transactions. This is the only method that preserves the dropped table's data while maintaining database consistency.

Answer

Restore the transaction log backup taken after the DROP TABLE and apply it to the database.

Answer

Use the RESTORE LOG statement with the NO_TRUNCATE option to recover the table.

Answer

Restore the most recent full backup and ignore subsequent transaction log backups.

Question 4

During a forensic investigation of a MongoDB database, the analyst needs to identify which user executed a particular write operation. Which MongoDB log or feature should the analyst examine?

Accepted Answer

Audit log (auditLog). The audit log (auditLog) is the correct source because it is specifically designed to record user authentication and database operations, including which user executed a write operation. MongoDB's audit system captures detailed events such as insert, update, and delete commands along with the authenticated user identity, making it the definitive forensic artifact for user attribution.

Answer

Journal (journal directory)

Answer

System log (mongod.log)

Answer

Oplog (local.oplog.rs)

Question 5

A forensic analyst is examining a PostgreSQL database server that was compromised. The attacker gained superuser access and deleted several rows from a critical table. The database is configured with WAL (Write-Ahead Log) archiving. Which method would allow the analyst to identify the exact time the deletions occurred?

Accepted Answer

Use the pg_waldump utility to parse the WAL files and identify DELETE operations with timestamps.. D is correct because `pg_waldump` is the PostgreSQL utility specifically designed to parse Write-Ahead Log (WAL) files and display their contents in a human-readable format, including the exact timestamps and operation types (e.g., DELETE). Since the database uses WAL archiving, the archived WAL segments will contain a record of every data modification, allowing the analyst to pinpoint when the deletions occurred.

Answer

Review the pg_stat_activity view to see the history of queries executed.

Answer

Examine the archive_status directory to find the timestamp of the WAL file that contains the deletion.

Answer

Query the pg_audit table to retrieve a log of all DELETE statements.

Question 6

Which TWO of the following are valid methods for collecting volatile data from a live database server during an incident response?

Accepted Answer

Execute netstat -an to list active network connections. Option D is correct because `netstat -an` lists all active network connections and listening ports without performing DNS resolution, which is critical for identifying unauthorized connections or ongoing data exfiltration from the live database server. This command retrieves data from the kernel's network stack, which is volatile and would be lost if the system were powered down.

Answer

Extract the file system journal

Answer

Take a backup of the database using mysqldump

Answer

Create a forensic image of the hard disk

Question 7

Which THREE of the following are essential steps in the forensic analysis of a compromised web application that uses a MySQL backend?

Accepted Answer

Check for suspicious stored procedures, triggers, or user-defined functions. Option C is correct because stored procedures, triggers, and user-defined functions (UDFs) in MySQL can be maliciously created or modified by an attacker to execute arbitrary code, escalate privileges, or maintain persistence. Forensic analysis must inspect these objects for unauthorized changes, as they are often overlooked but can contain backdoor logic that survives database restarts and backups.

Answer

Restore the database from the latest backup to ensure data integrity

Answer

Immediately change all database user passwords to prevent further access

Question 8

Refer to the exhibit. An analyst recovers this binary log entry from a MySQL server. What does the timestamp '190101 10:00:00' represent?

Accepted Answer

The time the DELETE statement was executed on the MySQL server. In MySQL binary logs, the timestamp in the 'Query' event header (e.g., '190101 10:00:00') records the server's local time when the statement began executing. This is the time the DELETE statement was actually processed by the MySQL server, not when the client sent it or when the log was written. The binary log captures the exact moment the server starts executing the query, making option A correct.

Answer

The time the client sent the query to the server

Answer

The time the binary log file was written to disk

Answer

The time the transaction was committed

Question 9

You are a forensic investigator responding to an incident at a financial institution. The organization uses Microsoft SQL Server 2016 for its transaction processing system. The database is configured with full recovery model and transaction log backups are taken every 15 minutes. The incident response team has identified that an attacker gained access to the database server via compromised credentials and executed a series of malicious SQL statements, including data exfiltration and deletion of critical records. The time of the attack is estimated to be between 2:00 PM and 2:05 PM. The last full backup was taken at 12:00 AM (midnight) the same day. Transaction log backups are available for the entire day. The last transaction log backup before the attack was taken at 1:45 PM. The next transaction log backup after the attack was taken at 2:15 PM. The database is still online and being used by the business. Management wants to recover the database to a point just before the attack (2:00 PM) to minimize data loss, while preserving evidence for investigation. Which of the following actions should you take FIRST?

Accepted Answer

Perform a tail-log backup of the database using the NORECOVERY option to capture all transactions since the last log backup.. Performing a tail-log backup with NORECOVERY captures all transactions committed after the last log backup (1:45 PM) up to the current point in time, including the attack period. This preserves the database in a restoring state, preventing further changes while allowing point-in-time recovery to just before 2:00 PM. It is the mandatory first step to minimize data loss and maintain forensic integrity before any restore operations.

Answer

Immediately restore the full backup from midnight and all transaction log backups up to 1:45 PM to a separate server for forensic analysis.

Answer

Shut down the SQL Server service to prevent further changes and then restore the database from backup.

Answer

Restore the database to a point in time using the full backup and all transaction log backups up to 1:45 PM, then apply the 2:15 PM backup to recover lost data.

Question 10

During a database forensic investigation, an analyst finds that the SQL Server transaction log contains gaps. Which TWO actions should the analyst take to preserve evidence integrity and recover missing transactions?

Accepted Answer

Perform a transaction log backup using BACKUP LOG. Option A is correct because performing a transaction log backup using BACKUP LOG captures the active portion of the transaction log, preserving evidence of all committed and uncommitted transactions. This ensures that the log is not truncated and that the forensic integrity of the transaction history is maintained for later analysis. Without this backup, subsequent operations could overwrite or lose critical transaction records.

Answer

Run DBCC CHECKDB to verify database consistency

Answer

Restart the SQL Server service to flush pending transactions

Answer

Truncate the transaction log to free space