>> Hi everyone, welcome back to the course.
The last module, we
wrapped up our discussion on web attacks.
In this module, we're going to
briefly cover database forensics.
We'll just talk about this at a very high level.
Just a quick pre-assessment question here.
The secondary data files are required,
is that true or false?
That's false.
The secondary data files are actually optional,
we'll talk about that in a little bit.
Microsoft SQL Server or MS SQL as
you might see it on the exam itself,
it's basically just a relational
database management system.
Different ways we can get information from it.
The transect, SQL or T-SQL
as it's more commonly called, snack and CLR.
SQL Server,
Native Client and the common language runtime.
In the forensic aspect of it,
data and logs are going to be stored
to three different files.
We've got the primary data file,
secondary data file, as well
as the transaction log data file.
Primary data file, as the name implies,
is a starting point of the database,
and then that points to
other files in the database, other areas.
For example, think of it like spaghetti and meatballs.
The meatball will be the starting point.
The primary data file and then it would have
all those little stringy paths or
the noodles to the other points in the database.
Normally we see it with the .MDF extension.
Definitely remember that for your exam,
and then it stores all data in database objects,
so things like tables, indexes, etc.
The secondary data file, this one is optional.
If you remember our pre-assessment question,
we said it was required,
it's actually optional,
and the database, can contain multiple.
You can have a single secondary file,
it could have multiple ones,
and it could even have zero of them.
Then the file type we normally see
is .NDF, the file extension.
Then the transaction log data file.
This one basically holds
the entire log information that's
associated with the database,
so this one helps a forensic investigator
examine the transactions that
were occurring in the database,
even if the data was deleted from the database.
That's one key aspect there.
This one's going to be an extension of.LDF.
One thing you're just going to want to memorize
for your exam is this path right here.
If you want to collect the MDF
and you're going to come to C program,
Microsoft SQL Server etc,
and then ending in MS SQL, backslash data.
Just remember that portion of it,
if you remember nothing else,
remember that last portion of it,
MS SQL, backward slash data, you should be good to go.
Some of it's common sense.
You figure that that would be in
the data area but just memorize for the exam.
Location of the files for restoration of evidence,
some other things you would just want to memorize here,
so the database and log files,
MS SQL backward slash data,
as we have just seen, trace files
MS SQL backward slash log.
Then the SQL Server air log files as the name implies,
MS. SQL log backward slash error log.
Different commands you'll just want to be
familiar with for the exam,
SQL commands, so that's for a system procedures.
The MySQL dump, that one takes a back of the database,
MySQL database export or DB Export,
>> export some metadata.
>> MyISAM law gives you
the version information and recovery operations.
It's used for recovery operations.
Then MyISAM check,
basically, checks the status of the MyISAM table.
The SQL Server plan cash.
I just want to basically
know what this is, What is it used for?
This stores details on
all the SQL statements that have been executed.
Even if, they're deleted,
it contains information about all of them,
so very important as an investigator.
Trace file collection.
This is going to be events that
occurred on the SQL Server and also the host database.
Again, just memorize this pass here,
the MS SQL backward
slash login and you should be good to go for the exam.
Just a quick post assessment
question on the command aspects.
The MySQL dump command
is used to get the version information.
Is that true or false?
All right, so that's false.
If you remember that, that commands
actually use to take a backup off the database,
and you will definitely want to know
>> that command for the exam.
>> This is shorter module video,
>> but we were just talking about
database forensics in this video,
in the next module,
we're going to talk about cloud forensics.