CHFI Database and Application Forensics Practice Question
You are a forensic investigator responding to an incident at a financial institution. The organization uses Microsoft SQL Server 2016 for its transaction processing system. The database is configured with full recovery model and transaction log backups are taken every 15 minutes. The incident response team has identified that an attacker gained access to the database server via compromised credentials and executed a series of malicious SQL statements, including data exfiltration and deletion of critical records. The time of the attack is estimated to be between 2:00 PM and 2:05 PM. The last full backup was taken at 12:00 AM (midnight) the same day. Transaction log backups are available for the entire day. The last transaction log backup before the attack was taken at 1:45 PM. The next transaction log backup after the attack was taken at 2:15 PM. The database is still online and being used by the business. Management wants to recover the database to a point just before the attack (2:00 PM) to minimize data loss, while preserving evidence for investigation. Which of the following actions should you take FIRST?
⚠ Common exam trap
The CHFI exam often tests the misconception that you should immediately restore from the last known good backup or shut down the server, when the correct first action is always to secure the current transaction log via a tail-log backup to capture all recent changes and enable precise point-in-time recovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a tail-log backup of the database using the NORECOVERY option to capture all transactions since the last log backup.
Performing a tail-log backup with NORECOVERY captures all transactions committed after the last log backup (1:45 PM) up to the current point in time, including the attack period. This preserves the database in a restoring state, preventing further changes while allowing point-in-time recovery to just before 2:00 PM. It is the mandatory first step to minimize data loss and maintain forensic integrity before any restore operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Perform a tail-log backup of the database using the NORECOVERY option to capture all transactions since the last log backup.
Why this is correct
Performing a tail-log backup with NORECOVERY captures every transaction that was recorded in the active portion of the transaction log after the last full transaction log backup, including transactions in flight or not yet backed up. The NORECOVERY option transitions the database into the Restoring state, preserving the current transaction log as a backup file that can be used for point-in-time recovery. This is the only way to preserve the complete post-backup forensic evidence, and it must be done before any restore operation is attempted.
- ✗
Immediately restore the full backup from midnight and all transaction log backups up to 1:45 PM to a separate server for forensic analysis.
Why it's wrong here
Restoring the full backup from midnight and the 1:45 PM log backups to a separate server would only reconstruct the database as of 1:45 PM, completely ignoring the active transaction log segment containing all transactions from 1:45 PM to the incident. This un-backed-up tail may hold the attacker's activity and is essential for both forensic analysis and complete recovery. You must first perform a tail-log backup; otherwise, the current state of evidence is lost. Restoring to a separate server is otherwise a sound analysis technique, but it is invalid without the tail log.
- ✗
Shut down the SQL Server service to prevent further changes and then restore the database from backup.
Why it's wrong here
Shutting down the SQL Server service does not safely capture the transaction log tail; in fact, on restart the database will run crash recovery, rolling forward and rolling back transactions, which modifies the log and can obscure the exact forensic timeline. Additionally, restoring the database from backup would overwrite the existing database files and destroy the very evidence you need to examine. The correct approach is to back up the tail-log first, and only then consider whether a shutdown is necessary, but never as a substitute for a proper log backup.
- ✗
Restore the database to a point in time using the full backup and all transaction log backups up to 1:45 PM, then apply the 2:15 PM backup to recover lost data.
Why it's wrong here
This plan incorrectly treats the 2:15 PM backup as a source of recovery, but that backup was taken after the attack and therefore contains the malicious transactions that you need to exclude. A point-in-time recovery should stop at the last known good point before the attack, not after it, and you must incorporate the tail-log backup to capture the current log. Applying the 2:15 PM backup would reintroduce the intrusion into any restored environment and is the opposite of a forensic recovery.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.