CHFI Application, Email and Cloud Forensics Practice Question
During a database forensic investigation, you need to review Microsoft SQL Server transaction logs to identify unauthorized data modifications. Which of the following SQL Server functions or commands is used to read the transaction log?
⚠ Common exam trap
EC-Council often tests the distinction between deprecated commands (DBCC LOG) and their modern replacements (fn_dblog), leading candidates to choose the familiar but outdated option B instead of the correct function C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
fn_dblog
The fn_dblog function is the correct choice because it is the undocumented but widely used SQL Server function that reads the transaction log (LDF file) directly, allowing forensic examiners to view every logged operation including data modifications, schema changes, and transaction details. Unlike other DMVs or commands, fn_dblog provides a row-by-row dump of the log records, making it essential for identifying unauthorized changes at the transaction level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SELECT * FROM sys.dm_tran_database_transactions
Why it's wrong here
The sys.dm_tran_database_transactions dynamic management view returns one row per active database transaction, exposing metadata such as transaction ID, begin time, state, and the aggregate number of log bytes consumed. It does not enumerate the individual log records or show the actual page modifications, row-level changes, or operation descriptions captured in the transaction log. For a forensic review of what was done, you need to inspect the log itself, not this high-level snapshot.
- ✗
DBCC LOG
Why it's wrong here
DBCC LOG with a detail level parameter can dump transaction log records, but it is an undocumented command whose output format is not officially supported and varies across SQL Server versions. It is much less practical and reliable for targeted forensic extraction than the table-valued fn_dblog function, which offers structured columns and filterable parameters for LSN ranges. Consequently, while it may reveal log data, it is not the preferred tool when you need a defensible, precise review of log records.
- ✓
fn_dblog
Why this is correct
fn_dblog is a table-valued function that accepts a starting and ending LSN and returns every transaction log record in that range, with columns such as Current LSN, Operation, Context, Transaction ID, Description, AllocUnitName, Page ID, and decoded row data. It allows an investigator to filter by operation type, transaction ID, or database object to reconstruct insert/update/delete activity, page allocations, and schema changes directly from the log. This makes it the standard, structured method for reviewing the actual log records during a database forensic investigation.
- ✗
BACKUP LOG
Why it's wrong here
BACKUP LOG is a maintenance or backup command that writes the transaction log to a backup device; it is not a way to read or inspect the log records interactively. Running it can also issue a truncation operation (unless COPY_ONLY is specified), which may remove the very log data that the investigation needs. Therefore it cannot serve as an option for reviewing log contents—it changes the evidence instead of exposing it.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.