CHFI Database and Application Forensics — All Questions With Answers

Question 1

During a database forensic investigation, an analyst discovers that multiple rows in a MySQL table have been deleted. The binary logs are enabled. Which approach should the analyst use to recover the deleted data?

Accepted Answer

Parse the binary logs using mysqlbinlog to extract the DELETE statements and reconstruct the lost data.. MySQL binary logs record all changes to the database, including DELETE statements. The mysqlbinlog utility can parse these logs to reconstruct the exact DELETE operations, allowing the analyst to reverse-engineer the deleted rows by extracting the row data from the log events. This is the standard forensic method for recovering deleted data when binary logging is enabled.

Answer

Restore the transaction log files from backup and mount them to recover the deleted rows.

Answer

Use the 'SHOW UNDO' command to retrieve the deleted rows from undo tablespace.

Answer

Query the information_schema database to retrieve deleted rows from the data dictionary.

Question 2

A forensic analyst is investigating a compromised web application that uses an Oracle database. The analyst suspects that SQL injection was used to extract sensitive data. Which Oracle log source would provide evidence of the injected SQL statements?

Accepted Answer

Listener log (listener.log). The listener.log is the correct source because Oracle's listener records all client connections and SQL*Net traffic, including the raw SQL statements sent to the database. When SQL injection is performed, the injected payload is transmitted as part of the SQL query over the network, and the listener log captures these exact statements, providing direct evidence of the attack.

Answer

Control file

Answer

Redo log files

Answer

Alert log (alert_SID.log)

Question 3

An organization uses Microsoft SQL Server 2019 with full recovery model. A database administrator accidentally executed a DROP TABLE statement. The transaction log was backed up immediately after the incident. Which forensic technique would allow the analyst to restore the dropped table?

Accepted Answer

Perform a tail-log backup, then restore the full backup and all subsequent transaction log backups, stopping before the DROP TABLE.. Option C is correct because, under the full recovery model, point-in-time recovery is required to undo the DROP TABLE. By performing a tail-log backup (to capture any transactions after the last log backup), then restoring the full backup and all subsequent transaction log backups with STOPAT or STOPBEFOREMARK to the moment just before the DROP TABLE, the analyst can recover the table without losing other transactions. This is the only method that preserves the dropped table's data while maintaining database consistency.

Answer

Restore the transaction log backup taken after the DROP TABLE and apply it to the database.

Answer

Use the RESTORE LOG statement with the NO_TRUNCATE option to recover the table.

Answer

Restore the most recent full backup and ignore subsequent transaction log backups.

Question 4

During a forensic investigation of a MongoDB database, the analyst needs to identify which user executed a particular write operation. Which MongoDB log or feature should the analyst examine?

Accepted Answer

Audit log (auditLog). The audit log (auditLog) is the correct source because it is specifically designed to record user authentication and database operations, including which user executed a write operation. MongoDB's audit system captures detailed events such as insert, update, and delete commands along with the authenticated user identity, making it the definitive forensic artifact for user attribution.

Answer

Journal (journal directory)

Answer

System log (mongod.log)

Answer

Oplog (local.oplog.rs)

Question 5

A forensic analyst is examining a PostgreSQL database server that was compromised. The attacker gained superuser access and deleted several rows from a critical table. The database is configured with WAL (Write-Ahead Log) archiving. Which method would allow the analyst to identify the exact time the deletions occurred?

Accepted Answer

Use the pg_waldump utility to parse the WAL files and identify DELETE operations with timestamps.. D is correct because `pg_waldump` is the PostgreSQL utility specifically designed to parse Write-Ahead Log (WAL) files and display their contents in a human-readable format, including the exact timestamps and operation types (e.g., DELETE). Since the database uses WAL archiving, the archived WAL segments will contain a record of every data modification, allowing the analyst to pinpoint when the deletions occurred.

Answer

Review the pg_stat_activity view to see the history of queries executed.

Answer

Examine the archive_status directory to find the timestamp of the WAL file that contains the deletion.

Answer

Query the pg_audit table to retrieve a log of all DELETE statements.

Question 6

Which TWO of the following are valid methods for collecting volatile data from a live database server during an incident response?

Accepted Answer

Execute netstat -an to list active network connections. Option D is correct because `netstat -an` lists all active network connections and listening ports without performing DNS resolution, which is critical for identifying unauthorized connections or ongoing data exfiltration from the live database server. This command retrieves data from the kernel's network stack, which is volatile and would be lost if the system were powered down.

Answer

Extract the file system journal

Answer

Take a backup of the database using mysqldump

Answer

Create a forensic image of the hard disk

Question 7

Which THREE of the following are essential steps in the forensic analysis of a compromised web application that uses a MySQL backend?

Accepted Answer

Check for suspicious stored procedures, triggers, or user-defined functions. Option C is correct because stored procedures, triggers, and user-defined functions (UDFs) in MySQL can be maliciously created or modified by an attacker to execute arbitrary code, escalate privileges, or maintain persistence. Forensic analysis must inspect these objects for unauthorized changes, as they are often overlooked but can contain backdoor logic that survives database restarts and backups.

Answer

Restore the database from the latest backup to ensure data integrity

Answer

Immediately change all database user passwords to prevent further access

Question 8

Refer to the exhibit. An analyst recovers this binary log entry from a MySQL server. What does the timestamp '190101 10:00:00' represent?

Accepted Answer

The time the DELETE statement was executed on the MySQL server. In MySQL binary logs, the timestamp in the 'Query' event header (e.g., '190101 10:00:00') records the server's local time when the statement began executing. This is the time the DELETE statement was actually processed by the MySQL server, not when the client sent it or when the log was written. The binary log captures the exact moment the server starts executing the query, making option A correct.

Answer

The time the client sent the query to the server

Answer

The time the binary log file was written to disk

Answer

The time the transaction was committed

Question 9

You are a forensic investigator responding to an incident at a financial institution. The organization uses Microsoft SQL Server 2016 for its transaction processing system. The database is configured with full recovery model and transaction log backups are taken every 15 minutes. The incident response team has identified that an attacker gained access to the database server via compromised credentials and executed a series of malicious SQL statements, including data exfiltration and deletion of critical records. The time of the attack is estimated to be between 2:00 PM and 2:05 PM. The last full backup was taken at 12:00 AM (midnight) the same day. Transaction log backups are available for the entire day. The last transaction log backup before the attack was taken at 1:45 PM. The next transaction log backup after the attack was taken at 2:15 PM. The database is still online and being used by the business. Management wants to recover the database to a point just before the attack (2:00 PM) to minimize data loss, while preserving evidence for investigation. Which of the following actions should you take FIRST?

Accepted Answer

Perform a tail-log backup of the database using the NORECOVERY option to capture all transactions since the last log backup.. Performing a tail-log backup with NORECOVERY captures all transactions committed after the last log backup (1:45 PM) up to the current point in time, including the attack period. This preserves the database in a restoring state, preventing further changes while allowing point-in-time recovery to just before 2:00 PM. It is the mandatory first step to minimize data loss and maintain forensic integrity before any restore operations.

Answer

Immediately restore the full backup from midnight and all transaction log backups up to 1:45 PM to a separate server for forensic analysis.

Answer

Shut down the SQL Server service to prevent further changes and then restore the database from backup.

Answer

Restore the database to a point in time using the full backup and all transaction log backups up to 1:45 PM, then apply the 2:15 PM backup to recover lost data.

Question 10

During a database forensic investigation, an analyst finds that the SQL Server transaction log contains gaps. Which TWO actions should the analyst take to preserve evidence integrity and recover missing transactions?

Accepted Answer

Perform a transaction log backup using BACKUP LOG. Option A is correct because performing a transaction log backup using BACKUP LOG captures the active portion of the transaction log, preserving evidence of all committed and uncommitted transactions. This ensures that the log is not truncated and that the forensic integrity of the transaction history is maintained for later analysis. Without this backup, subsequent operations could overwrite or lose critical transaction records.

Answer

Run DBCC CHECKDB to verify database consistency

Answer

Restart the SQL Server service to flush pending transactions

Answer

Truncate the transaction log to free space

Question 11

Refer to the exhibit. An investigator runs the queries on an Oracle database during a live forensic acquisition. What does the output indicate about the database transaction state?

Accepted Answer

Exactly one transaction is currently active. The query `SELECT COUNT(*) FROM v$transaction;` returns a count of 1, which indicates that exactly one transaction is currently active in the Oracle database. The `v$transaction` view shows only uncommitted or unrolled-back transactions; a committed transaction is removed from this view. Therefore, the output confirms that one transaction is active and has not yet been committed or rolled back.

Answer

The transaction has been rolled back

Answer

The transaction has been committed

Answer

No transactions are currently active

Question 12

You are investigating a suspected data exfiltration incident at a financial institution. The database is MySQL 8.0 running on Linux. The security team suspects that a user with administrative privileges exported sensitive customer records via SELECT INTO OUTFILE and then deleted the output file. The MySQL general log is enabled and located at /var/log/mysql/mysql.log. However, the log file appears to be truncated and only contains entries from the last hour. The binary log is also enabled, and the binary log files are stored in /var/lib/mysql/binlog.000001 through binlog.000005. The database is actively being used. Which of the following is the BEST course of action to recover evidence of the SELECT INTO OUTFILE command that may have occurred 3 hours ago?

Accepted Answer

Parse the binary log files using mysqlbinlog to extract all statements from the relevant time period. The binary log records all data-changing statements (including DDL and DML) and is not truncated like the general log. Since the incident occurred 3 hours ago and the general log only covers the last hour, the binary log files (binlog.000001–000005) are the only persistent record. Using mysqlbinlog to parse these files can recover the SELECT INTO OUTFILE statement from the relevant time period, even if the output file was deleted.

Answer

Analyze the general log file using grep and tail to search for SELECT INTO OUTFILE

Answer

Examine the InnoDB redo log files to find the SELECT INTO OUTFILE command

Answer

Enable MySQL audit logging and wait for the activity to reoccur

Question 13

During a database forensic investigation, an analyst recovers a MySQL binary log file (binlog.000012) from a compromised server. Which command should the analyst use to extract the actual SQL statements from this binary log in a human-readable format?

Accepted Answer

mysqlbinlog binlog.000012. The `mysqlbinlog` utility is specifically designed to parse MySQL binary log files and output the contained SQL statements in a human-readable format. Binary logs record all data-changing operations (e.g., INSERT, UPDATE, DELETE) in a proprietary binary format, so only `mysqlbinlog` can decode them back into readable SQL for forensic analysis.

Answer

mysqldump --binlog binlog.000012

Answer

mysqlimport --binlog binlog.000012

Answer

mysqlcheck --binlog binlog.000012

Question 14

Refer to the exhibit. A database administrator finds the above error log entries when attempting to start the MySQL service. The server was working fine yesterday. What is the most likely cause of this issue?

Accepted Answer

The InnoDB system tablespace file (ibdata1) is corrupted.. The error log entries indicate that InnoDB is unable to open or read the system tablespace file (ibdata1), which is the core file storing the InnoDB data dictionary, undo logs, and doublewrite buffer. A corrupted ibdata1 prevents MySQL from starting because the storage engine cannot initialize its internal structures, even if the server was operational the previous day. This matches the symptom of a sudden failure without prior configuration changes.

Answer

The MySQL user does not have write permissions to the data directory.

Answer

The binary log is full and cannot be rotated.

Answer

The server ran out of memory due to high innodb_buffer_pool_size.

Question 15

A forensic investigator is analyzing a Microsoft SQL Server instance that was compromised. The investigator wants to identify all login attempts that failed due to incorrect passwords. Which system function or view should be queried?

Accepted Answer

xp_readerrorlog with filter for 'Login failed'. The xp_readerrorlog extended stored procedure reads the SQL Server error log, which records all login attempts, including failures. By filtering for 'Login failed', the investigator can retrieve the exact entries where authentication failed due to incorrect passwords. This is the standard method for auditing failed logins in SQL Server.

Answer

sys.dm_exec_sessions

Answer

sys.dm_tran_locks

Answer

sys.dm_exec_requests

Question 16

Drag and drop the steps to perform a forensic examination of a mobile device (Android) using Cellebrite UFED into the correct order.

Question 17

Match each file carving technique to its description.

CHFI Database and Application Forensics — All Questions With Answers

During a database forensic investigation, an analyst discovers that multiple rows in a MySQL table have been deleted. The binary logs are enabled. Which approach should the analyst use to recover the deleted data?

A forensic analyst is investigating a compromised web application that uses an Oracle database. The analyst suspects that SQL injection was used to extract sensitive data. Which Oracle log source would provide evidence of the injected SQL statements?

An organization uses Microsoft SQL Server 2019 with full recovery model. A database administrator accidentally executed a DROP TABLE statement. The transaction log was backed up immediately after the incident. Which forensic technique would allow the analyst to restore the dropped table?

During a forensic investigation of a MongoDB database, the analyst needs to identify which user executed a particular write operation. Which MongoDB log or feature should the analyst examine?

Which TWO of the following are valid methods for collecting volatile data from a live database server during an incident response?

Which THREE of the following are essential steps in the forensic analysis of a compromised web application that uses a MySQL backend?

Refer to the exhibit. An analyst recovers this binary log entry from a MySQL server. What does the timestamp '190101 10:00:00' represent?

Exhibit

During a database forensic investigation, an analyst finds that the SQL Server transaction log contains gaps. Which TWO actions should the analyst take to preserve evidence integrity and recover missing transactions?

Refer to the exhibit. An investigator runs the queries on an Oracle database during a live forensic acquisition. What does the output indicate about the database transaction state?

Exhibit

During a database forensic investigation, an analyst recovers a MySQL binary log file (binlog.000012) from a compromised server. Which command should the analyst use to extract the actual SQL statements from this binary log in a human-readable format?

Refer to the exhibit. A database administrator finds the above error log entries when attempting to start the MySQL service. The server was working fine yesterday. What is the most likely cause of this issue?

Exhibit

A forensic investigator is analyzing a Microsoft SQL Server instance that was compromised. The investigator wants to identify all login attempts that failed due to incorrect passwords. Which system function or view should be queried?

Drag and drop the steps to perform a forensic examination of a mobile device (Android) using Cellebrite UFED into the correct order.

Match each file carving technique to its description.

CHFI Database and Application Forensics — All Questions With Answers

During a database forensic investigation, an analyst discovers that multiple rows in a MySQL table have been deleted. The binary logs are enabled. Which approach should the analyst use to recover the deleted data?

A forensic analyst is investigating a compromised web application that uses an Oracle database. The analyst suspects that SQL injection was used to extract sensitive data. Which Oracle log source would provide evidence of the injected SQL statements?

An organization uses Microsoft SQL Server 2019 with full recovery model. A database administrator accidentally executed a DROP TABLE statement. The transaction log was backed up immediately after the incident. Which forensic technique would allow the analyst to restore the dropped table?

During a forensic investigation of a MongoDB database, the analyst needs to identify which user executed a particular write operation. Which MongoDB log or feature should the analyst examine?

Which TWO of the following are valid methods for collecting volatile data from a live database server during an incident response?

Which THREE of the following are essential steps in the forensic analysis of a compromised web application that uses a MySQL backend?

Refer to the exhibit. An analyst recovers this binary log entry from a MySQL server. What does the timestamp '190101 10:00:00' represent?

Exhibit

During a database forensic investigation, an analyst finds that the SQL Server transaction log contains gaps. Which TWO actions should the analyst take to preserve evidence integrity and recover missing transactions?

Refer to the exhibit. An investigator runs the queries on an Oracle database during a live forensic acquisition. What does the output indicate about the database transaction state?

Exhibit

During a database forensic investigation, an analyst recovers a MySQL binary log file (binlog.000012) from a compromised server. Which command should the analyst use to extract the actual SQL statements from this binary log in a human-readable format?

Refer to the exhibit. A database administrator finds the above error log entries when attempting to start the MySQL service. The server was working fine yesterday. What is the most likely cause of this issue?

Exhibit

A forensic investigator is analyzing a Microsoft SQL Server instance that was compromised. The investigator wants to identify all login attempts that failed due to incorrect passwords. Which system function or view should be queried?

Drag and drop the steps to perform a forensic examination of a mobile device (Android) using Cellebrite UFED into the correct order.

Match each file carving technique to its description.