How should I use these Database and Application Forensics practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

CHFI · topic practice

Database and Application Forensics practice questions

Q: Can I practise just Database and Application Forensics questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Database and Application Forensics domain.

Practise Computer Hacking Forensic Investigator CHFI Database and Application Forensics practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

17 questionsDomain: Database and Application Forensics

Practice 10 questions Browse domain →

What the exam tests

What to know about Database and Application Forensics

Database and Application Forensics questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Database and Application Forensics exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Database and Application Forensics questions

17 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Database and Application Forensics explanation →

During a database forensic investigation, an analyst discovers that multiple rows in a MySQL table have been deleted. The binary logs are enabled. Which approach should the analyst use to recover the deleted data?

Trap 1: Restore the transaction log files from backup and mount them to…

Transaction logs (redo logs) are not designed for direct recovery of deleted rows; binary logs are used.

Trap 2: Use the 'SHOW UNDO' command to retrieve the deleted rows from undo…

MySQL does not have a SHOW UNDO command.

Trap 3: Query the information_schema database to retrieve deleted rows from…

Information_schema contains metadata, not actual row data.

Study all Database and Application Forensics common traps →

A
Restore the transaction log files from backup and mount them to recover the deleted rows.
Why wrong: Transaction logs (redo logs) are not designed for direct recovery of deleted rows; binary logs are used.
B
Use the 'SHOW UNDO' command to retrieve the deleted rows from undo tablespace.
Why wrong: MySQL does not have a SHOW UNDO command.
C
Query the information_schema database to retrieve deleted rows from the data dictionary.
Why wrong: Information_schema contains metadata, not actual row data.
D
Parse the binary logs using mysqlbinlog to extract the DELETE statements and reconstruct the lost data.
Binary logs record all data changes; mysqlbinlog can output the SQL statements, including deletes.

Full breakdown with real-world context →

Question 2easymultiple choice

Read the full Database and Application Forensics explanation →

A forensic analyst is investigating a compromised web application that uses an Oracle database. The analyst suspects that SQL injection was used to extract sensitive data. Which Oracle log source would provide evidence of the injected SQL statements?

Trap 1: Control file

Control file stores database structure, not SQL.

Trap 2: Redo log files

Redo logs record changes, not the SQL statements that caused them.

Trap 3: Alert log (alert_SID.log)

Alert logs contain system events, not SQL statements.

Study all Database and Application Forensics common traps →

A
Control file
Why wrong: Control file stores database structure, not SQL.
B
Redo log files
Why wrong: Redo logs record changes, not the SQL statements that caused them.
C
Listener log (listener.log)
With audit enabled, the listener log can capture SQL statements.
D
Alert log (alert_SID.log)
Why wrong: Alert logs contain system events, not SQL statements.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Database and Application Forensics explanation →

An organization uses Microsoft SQL Server 2019 with full recovery model. A database administrator accidentally executed a DROP TABLE statement. The transaction log was backed up immediately after the incident. Which forensic technique would allow the analyst to restore the dropped table?

Trap 1: Restore the transaction log backup taken after the DROP TABLE and…

That log includes the DROP, so the table would be dropped again.

Trap 2: Use the RESTORE LOG statement with the NO_TRUNCATE option to…

NO_TRUNCATE is used for tail-log backup, not for recovery of dropped objects.

Trap 3: Restore the most recent full backup and ignore subsequent…

This would lose all changes after the full backup.

Study all Database and Application Forensics common traps →

A
Restore the transaction log backup taken after the DROP TABLE and apply it to the database.
Why wrong: That log includes the DROP, so the table would be dropped again.
B
Use the RESTORE LOG statement with the NO_TRUNCATE option to recover the table.
Why wrong: NO_TRUNCATE is used for tail-log backup, not for recovery of dropped objects.
C
Perform a tail-log backup, then restore the full backup and all subsequent transaction log backups, stopping before the DROP TABLE.
Point-in-time restore allows recovery to just before the drop.
D
Restore the most recent full backup and ignore subsequent transaction log backups.
Why wrong: This would lose all changes after the full backup.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Database and Application Forensics explanation →

During a forensic investigation of a MongoDB database, the analyst needs to identify which user executed a particular write operation. Which MongoDB log or feature should the analyst examine?

Trap 1: Journal (journal directory)

Journal is for crash recovery, not audit.

Trap 2: System log (mongod.log)

System log contains general messages, not user-specific actions.

Trap 3: Oplog (local.oplog.rs)

The oplog logs operations for replication, not user identity.

Study all Database and Application Forensics common traps →

A
Journal (journal directory)
Why wrong: Journal is for crash recovery, not audit.
B
System log (mongod.log)
Why wrong: System log contains general messages, not user-specific actions.
C
Audit log (auditLog)
Audit log records user actions when enabled.
D
Oplog (local.oplog.rs)
Why wrong: The oplog logs operations for replication, not user identity.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Database and Application Forensics explanation →

A forensic analyst is examining a PostgreSQL database server that was compromised. The attacker gained superuser access and deleted several rows from a critical table. The database is configured with WAL (Write-Ahead Log) archiving. Which method would allow the analyst to identify the exact time the deletions occurred?

Trap 1: Review the pg_stat_activity view to see the history of queries…

pg_stat_activity shows only current sessions, not historical queries.

Trap 2: Examine the archive_status directory to find the timestamp of the…

archive_status only shows which files have been archived, not their contents.

Trap 3: Query the pg_audit table to retrieve a log of all DELETE statements.

pg_audit is not a default table; audit logging must be configured separately.

Study all Database and Application Forensics common traps →

A
Review the pg_stat_activity view to see the history of queries executed.
Why wrong: pg_stat_activity shows only current sessions, not historical queries.
B
Examine the archive_status directory to find the timestamp of the WAL file that contains the deletion.
Why wrong: archive_status only shows which files have been archived, not their contents.
C
Query the pg_audit table to retrieve a log of all DELETE statements.
Why wrong: pg_audit is not a default table; audit logging must be configured separately.
D
Use the pg_waldump utility to parse the WAL files and identify DELETE operations with timestamps.
pg_waldump can decode WAL records, showing the exact operations and timestamps.

Full breakdown with real-world context →

Question 6easymulti select

Read the full Database and Application Forensics explanation →

Which TWO of the following are valid methods for collecting volatile data from a live database server during an incident response?

Trap 1: Extract the file system journal

File system journal is on disk, not volatile.

Trap 2: Take a backup of the database using mysqldump

Database backup is non-volatile.

Trap 3: Create a forensic image of the hard disk

Disk imaging is non-volatile data collection.

Study all Database and Application Forensics common traps →

A
Extract the file system journal
Why wrong: File system journal is on disk, not volatile.
B
Take a backup of the database using mysqldump
Why wrong: Database backup is non-volatile.
C
Create a forensic image of the hard disk
Why wrong: Disk imaging is non-volatile data collection.
D
Execute netstat -an to list active network connections
Netstat shows current connections, which are volatile.
E
Capture a memory dump using a tool like LiME or FTK Imager
Memory dump captures volatile data.

Full breakdown with real-world context →

Question 7mediummulti select

Read the full Database and Application Forensics explanation →

Which THREE of the following are essential steps in the forensic analysis of a compromised web application that uses a MySQL backend?

Trap 1: Restore the database from the latest backup to ensure data integrity

Restoring overwrites current evidence.

Trap 2: Immediately change all database user passwords to prevent further…

Changing passwords alters the environment and may destroy evidence.

Study all Database and Application Forensics common traps →

A
Restore the database from the latest backup to ensure data integrity
Why wrong: Restoring overwrites current evidence.
B
Immediately change all database user passwords to prevent further access
Why wrong: Changing passwords alters the environment and may destroy evidence.
C
Check for suspicious stored procedures, triggers, or user-defined functions
Attackers may create malicious objects for persistence.
D
Analyze web server access logs to identify SQL injection attempts
Web logs can show the attack vector.
E
Preserve the MySQL binary logs for timeline analysis
Binary logs record all changes and are essential for reconstruction.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Database and Application Forensics explanation →

Refer to the exhibit. An analyst recovers this binary log entry from a MySQL server. What does the timestamp '190101 10:00:00' represent?

Exhibit

Refer to the exhibit.

```
MySQL Binary Log Entry:
# at 12345678
#190101 10:00:00 server id 1  end_log_pos 12345679 CRC32 0x12345678 	Query	thread_id=100	exec_time=0	error_code=0
SET TIMESTAMP=1546334400/*!*/;
DELETE FROM users WHERE id=5
/*!*/;
```

Trap 1: The time the client sent the query to the server

The timestamp is server-side, not client-side.

Trap 2: The time the binary log file was written to disk

The timestamp is the execution time, not the write time.

Trap 3: The time the transaction was committed

For non-transactional statements like DELETE, there is no commit; the timestamp is execution time.

Study all Database and Application Forensics common traps →

A
The time the DELETE statement was executed on the MySQL server
The timestamp records when the server executed the statement.
B
The time the client sent the query to the server
Why wrong: The timestamp is server-side, not client-side.
C
The time the binary log file was written to disk
Why wrong: The timestamp is the execution time, not the write time.
D
The time the transaction was committed
Why wrong: For non-transactional statements like DELETE, there is no commit; the timestamp is execution time.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full Database and Application Forensics explanation →

You are a forensic investigator responding to an incident at a financial institution. The organization uses Microsoft SQL Server 2016 for its transaction processing system. The database is configured with full recovery model and transaction log backups are taken every 15 minutes. The incident response team has identified that an attacker gained access to the database server via compromised credentials and executed a series of malicious SQL statements, including data exfiltration and deletion of critical records. The time of the attack is estimated to be between 2:00 PM and 2:05 PM. The last full backup was taken at 12:00 AM (midnight) the same day. Transaction log backups are available for the entire day. The last transaction log backup before the attack was taken at 1:45 PM. The next transaction log backup after the attack was taken at 2:15 PM. The database is still online and being used by the business. Management wants to recover the database to a point just before the attack (2:00 PM) to minimize data loss, while preserving evidence for investigation. Which of the following actions should you take FIRST?

Trap 1: Immediately restore the full backup from midnight and all…

This would not capture the tail of the log; the current state is needed for evidence and recovery.

Trap 2: Shut down the SQL Server service to prevent further changes and…

Shutting down may damage evidence and does not capture the tail log; restoration should be done after tail-log backup.

Trap 3: Restore the database to a point in time using the full backup and…

The 2:15 PM backup contains the attack; you need to stop before 2:00 PM. Also, you must first back up the tail log.

Study all Database and Application Forensics common traps →

A
Perform a tail-log backup of the database using the NORECOVERY option to capture all transactions since the last log backup.
This captures the current state, enabling point-in-time recovery and preserving evidence.
B
Immediately restore the full backup from midnight and all transaction log backups up to 1:45 PM to a separate server for forensic analysis.
Why wrong: This would not capture the tail of the log; the current state is needed for evidence and recovery.
C
Shut down the SQL Server service to prevent further changes and then restore the database from backup.
Why wrong: Shutting down may damage evidence and does not capture the tail log; restoration should be done after tail-log backup.
D
Restore the database to a point in time using the full backup and all transaction log backups up to 1:45 PM, then apply the 2:15 PM backup to recover lost data.
Why wrong: The 2:15 PM backup contains the attack; you need to stop before 2:00 PM. Also, you must first back up the tail log.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full Database and Application Forensics explanation →

During a database forensic investigation, an analyst finds that the SQL Server transaction log contains gaps. Which TWO actions should the analyst take to preserve evidence integrity and recover missing transactions?

Trap 1: Run DBCC CHECKDB to verify database consistency

Does not recover log gaps.

Trap 2: Restart the SQL Server service to flush pending transactions

May overwrite log buffer data.

Trap 3: Truncate the transaction log to free space

Destroys potential evidence.

Study all Database and Application Forensics common traps →

A
Perform a transaction log backup using BACKUP LOG
Preserves the current log state for analysis.
B
Run DBCC CHECKDB to verify database consistency
Why wrong: Does not recover log gaps.
C
Restart the SQL Server service to flush pending transactions
Why wrong: May overwrite log buffer data.
D
Truncate the transaction log to free space
Why wrong: Destroys potential evidence.
E
Use DBCC PAGE or fn_dblog to read the transaction log
Allows direct examination of log records.

Full breakdown with real-world context →

Question 11easymultiple choice

Read the full Database and Application Forensics explanation →

Refer to the exhibit. An investigator runs the queries on an Oracle database during a live forensic acquisition. What does the output indicate about the database transaction state?

Exhibit

Refer to the exhibit.

```
SQL> SELECT * FROM v$transaction;

ADDR           XIDUSN XIDSLOT XIDSQN  UBAFIL  UBABLK  UBASQN  UBAOFF  STATUS   START_SCNBAS START_SCNWRP
-------------- ------ ------- ------  ------  ------  ------  ------  -------- ------------ ------------
00000000C0F8  10     12      123456  4       5678    890     0       ACTIVE   1234567890   1

SQL> SELECT COUNT(*) FROM v$transaction WHERE status='ACTIVE';

  COUNT(*)
----------
         1
```

Trap 1: The transaction has been rolled back

Status is ACTIVE, not rolled back.

Trap 2: The transaction has been committed

Status is ACTIVE, not committed.

Trap 3: No transactions are currently active

The count shows 1 active transaction.

Study all Database and Application Forensics common traps →

A
The transaction has been rolled back
Why wrong: Status is ACTIVE, not rolled back.
B
The transaction has been committed
Why wrong: Status is ACTIVE, not committed.
C
No transactions are currently active
Why wrong: The count shows 1 active transaction.
D
Exactly one transaction is currently active
The query returns one row with status ACTIVE.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full Database and Application Forensics explanation →

You are investigating a suspected data exfiltration incident at a financial institution. The database is MySQL 8.0 running on Linux. The security team suspects that a user with administrative privileges exported sensitive customer records via SELECT INTO OUTFILE and then deleted the output file. The MySQL general log is enabled and located at /var/log/mysql/mysql.log. However, the log file appears to be truncated and only contains entries from the last hour. The binary log is also enabled, and the binary log files are stored in /var/lib/mysql/binlog.000001 through binlog.000005. The database is actively being used. Which of the following is the BEST course of action to recover evidence of the SELECT INTO OUTFILE command that may have occurred 3 hours ago?

Trap 1: Analyze the general log file using grep and tail to search for…

The general log only contains entries from the last hour; the event occurred 3 hours ago.

Trap 2: Examine the InnoDB redo log files to find the SELECT INTO OUTFILE…

Redo logs do not record SELECT statements.

Trap 3: Enable MySQL audit logging and wait for the activity to reoccur

The event already happened; waiting will not recover past evidence.

Study all Database and Application Forensics common traps →

A
Parse the binary log files using mysqlbinlog to extract all statements from the relevant time period
Binary logs contain historical SQL statements including SELECT INTO OUTFILE.
B
Analyze the general log file using grep and tail to search for SELECT INTO OUTFILE
Why wrong: The general log only contains entries from the last hour; the event occurred 3 hours ago.
C
Examine the InnoDB redo log files to find the SELECT INTO OUTFILE command
Why wrong: Redo logs do not record SELECT statements.
D
Enable MySQL audit logging and wait for the activity to reoccur
Why wrong: The event already happened; waiting will not recover past evidence.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full Database and Application Forensics explanation →

During a database forensic investigation, an analyst recovers a MySQL binary log file (binlog.000012) from a compromised server. Which command should the analyst use to extract the actual SQL statements from this binary log in a human-readable format?

Trap 1: mysqldump --binlog binlog.000012

mysqldump does not parse binary logs.

Trap 2: mysqlimport --binlog binlog.000012

mysqlimport imports text files, not binary logs.

Trap 3: mysqlcheck --binlog binlog.000012

mysqlcheck checks tables, not binary logs.

Study all Database and Application Forensics common traps →

A
mysqldump --binlog binlog.000012
Why wrong: mysqldump does not parse binary logs.
B
mysqlimport --binlog binlog.000012
Why wrong: mysqlimport imports text files, not binary logs.
C
mysqlcheck --binlog binlog.000012
Why wrong: mysqlcheck checks tables, not binary logs.
D
mysqlbinlog binlog.000012
mysqlbinlog converts binary log to SQL text.

Full breakdown with real-world context →

Question 14hardmultiple choice

Read the full Database and Application Forensics explanation →

Refer to the exhibit. A database administrator finds the above error log entries when attempting to start the MySQL service. The server was working fine yesterday. What is the most likely cause of this issue?

Exhibit

Refer to the exhibit.

Exhibit:
```
MySQL Error Log Entry:
[ERROR] Plugin 'InnoDB' init function returned error.
[ERROR] Plugin 'InnoDB' registration as a STORAGE ENGINE failed.
[ERROR] Unknown/unsupported storage engine: InnoDB
[ERROR] Aborting
```

Trap 1: The MySQL user does not have write permissions to the data…

Permission issues would cause different errors.

Trap 2: The binary log is full and cannot be rotated.

Binary log issues do not prevent InnoDB loading.

Trap 3: The server ran out of memory due to high innodb_buffer_pool_size.

Out of memory errors would appear differently.

Study all Database and Application Forensics common traps →

A
The MySQL user does not have write permissions to the data directory.
Why wrong: Permission issues would cause different errors.
B
The binary log is full and cannot be rotated.
Why wrong: Binary log issues do not prevent InnoDB loading.
C
The server ran out of memory due to high innodb_buffer_pool_size.
Why wrong: Out of memory errors would appear differently.
D
The InnoDB system tablespace file (ibdata1) is corrupted.
Corrupt ibdata1 prevents InnoDB initialization.

Full breakdown with real-world context →

Question 15easymultiple choice

Read the full Database and Application Forensics explanation →

A forensic investigator is analyzing a Microsoft SQL Server instance that was compromised. The investigator wants to identify all login attempts that failed due to incorrect passwords. Which system function or view should be queried?

Trap 1: sys.dm_exec_sessions

Shows active sessions, not login failures.

Trap 2: sys.dm_tran_locks

Shows lock information, not logins.

Trap 3: sys.dm_exec_requests

Shows current requests, not login history.

Study all Database and Application Forensics common traps →

A
sys.dm_exec_sessions
Why wrong: Shows active sessions, not login failures.
B
sys.dm_tran_locks
Why wrong: Shows lock information, not logins.
C
xp_readerrorlog with filter for 'Login failed'
Reads SQL Server error log for failed logins.
D
sys.dm_exec_requests
Why wrong: Shows current requests, not login history.

Full breakdown with real-world context →

Question 16mediumdrag order

Read the full NAT/PAT explanation →

Drag and drop the steps to perform a forensic examination of a mobile device (Android) using Cellebrite UFED into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 17mediummatching

Read the full Database and Application Forensics explanation →

Match each file carving technique to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Uses file signatures to find start and end

Uses internal file structure metadata

Reassembles fragmented files

Uses statistical models to identify file types

Handles files split into two fragments

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Database and Application Forensics sessions

Start a Database and Application Forensics only practice session

Every question in these sessions is drawn from the Database and Application Forensics domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Database and Application Forensics questions →Mixed CHFI session

Frequently asked questions

What does the CHFI exam test about Database and Application Forensics?: Database and Application Forensics questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Database and Application Forensics questions in a focused session?: Yes — the session launcher on this page draws every question from the Database and Application Forensics domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CHFI topics?: Use the topic links above to move to related areas, or go back to the CHFI question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CHFI exam covers. They are not copied from any real exam or dump site.

Database and Application Forensics only

10 questions 20 questions 30 questions 50 questions

Mixed CHFI session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CHFI questions Database and Application Forensics domain overview CHFI exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Database and Application Forensics practice questions

What to know about Database and Application Forensics

Common Database and Application Forensics exam traps

Database and Application Forensics questions

During a database forensic investigation, an analyst discovers that multiple rows in a MySQL table have been deleted. The binary logs are enabled. Which approach should the analyst use to recover the deleted data?

A forensic analyst is investigating a compromised web application that uses an Oracle database. The analyst suspects that SQL injection was used to extract sensitive data. Which Oracle log source would provide evidence of the injected SQL statements?

An organization uses Microsoft SQL Server 2019 with full recovery model. A database administrator accidentally executed a DROP TABLE statement. The transaction log was backed up immediately after the incident. Which forensic technique would allow the analyst to restore the dropped table?

During a forensic investigation of a MongoDB database, the analyst needs to identify which user executed a particular write operation. Which MongoDB log or feature should the analyst examine?

Which TWO of the following are valid methods for collecting volatile data from a live database server during an incident response?

Which THREE of the following are essential steps in the forensic analysis of a compromised web application that uses a MySQL backend?

Refer to the exhibit. An analyst recovers this binary log entry from a MySQL server. What does the timestamp '190101 10:00:00' represent?

Exhibit

During a database forensic investigation, an analyst finds that the SQL Server transaction log contains gaps. Which TWO actions should the analyst take to preserve evidence integrity and recover missing transactions?

Refer to the exhibit. An investigator runs the queries on an Oracle database during a live forensic acquisition. What does the output indicate about the database transaction state?

Exhibit

During a database forensic investigation, an analyst recovers a MySQL binary log file (binlog.000012) from a compromised server. Which command should the analyst use to extract the actual SQL statements from this binary log in a human-readable format?

Refer to the exhibit. A database administrator finds the above error log entries when attempting to start the MySQL service. The server was working fine yesterday. What is the most likely cause of this issue?

Exhibit

A forensic investigator is analyzing a Microsoft SQL Server instance that was compromised. The investigator wants to identify all login attempts that failed due to incorrect passwords. Which system function or view should be queried?

Drag and drop the steps to perform a forensic examination of a mobile device (Android) using Cellebrite UFED into the correct order.

Match each file carving technique to its description.

Track your progress over time

Start a Database and Application Forensics only practice session

Related CHFI topic practice pages

Computer Forensics Investigation Process practice questions

Computer Forensics Fundamentals and Process practice questions

Storage Forensics and File System Analysis practice questions

Incident Response and First Responder Skills practice questions

Computer Forensics Lab practice questions

Evidence Acquisition and Duplication practice questions

OS and Network Forensics practice questions

OS and File System Forensics practice questions

Application, Email and Cloud Forensics practice questions

Mobile and Malware Forensics practice questions

Network and Cloud Forensics practice questions