CHFI MySQL Binary Log Practice Question
A forensic analyst is examining MySQL binary logs to identify a data exfiltration event. Which TWO fields are most critical for reconstructing the stolen data?
⚠ Common exam trap
EC-Council often tests the misconception that SQL statements are always present in binary logs. However, binary logs only record data-changing operations (INSERT, UPDATE, DELETE, DDL), not SELECT queries used for typical data exfiltration. The critical fields for reconstructing stolen data from binary logs are timestamp and thread ID, which allow correlation with other logs that capture the actual SELECT statements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Timestamp
Timestamp (B) is critical for reconstructing the stolen data because it establishes the exact sequence of events, allowing correlation with other logs (e.g., general query log) to pinpoint when exfiltration occurred. Thread ID (E) uniquely identifies the database connection; by correlating thread IDs across binary logs and general query logs, the analyst can trace all queries (including SELECTs) executed by the same connection, revealing the exfiltration queries that are not recorded in binary logs. Together, these fields enable chronological and connection-based reconstruction, compensating for the binary log's lack of SELECT logging.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Error code
Why it's wrong here
MySQL binlog does not routinely record per-event error codes; the error code field in binlog event headers reflects the success status for the statement, not the data content. A zero error code only indicates that the query succeeded, and it bears no relationship to the rows that were read or copied via SELECT, making it useless for reconstructing exfiltrated datasets.
- ✓
Timestamp
Why this is correct
Binlog event headers include a timestamp (in seconds since epoch) that enables forensic reconstruction of the exact order in which transactions occurred. This chronology is essential for correlating binlog events with other logs (e.g., access logs) to pinpoint when data was accessed and exfiltrated, and for establishing a timeline of an attacker's actions.
- ✗
Server ID
Why it's wrong here
In MySQL binary logs, server_id is a replication metadata field that identifies the originating server in a replication topology. In a single-server forensic context, it cannot help reconstruct exfiltration because it does not tie events to users or connections, and all local events share the same server ID, so it provides no temporal or session-specific differentiation. It only matters when correlating across multiple servers to determine which server produced a given statement.
- ✗
SQL statement
Why it's wrong here
Binary logging captures row changes or SQL statements for write operations (INSERT, UPDATE, DELETE) in ROW or STATEMENT format, but it deliberately omits SELECT queries, which are the primary vector for data exfiltration. Even when the original SELECT is available in the general query log, the binary log's recorded SQL statements only reflect the resulting modifications, not the data that left the server.
- ✓
Thread ID
Why this is correct
Thread ID (thread_id) in binlog events corresponds to the connection/session that executed the transaction. Because binary logs omit SELECT statements, the thread ID is critical for linking the logged writes to the same session's SELECTs captured in the general query log, thereby revealing data exfiltration.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.