Computer Hacking Forensic Investigator (CHFI v10) — Question 379

Which of the following files store the MySQL database data permanently, including the data that had been deleted, helping the forensic investigator in examining the case and finding the culprit?

Answer options

• A. mysql-bin
• B. mysql-log
• C. iblog
• D. ibdata1

Correct answer: D

Explanation

The ibdata1 file stores the actual data for InnoDB tables, including deleted records, making it crucial for forensic analysis. The mysql-bin file contains binary logs for replication but not the full dataset, while mysql-log is not a standard MySQL log file. The iblog option is incorrect as it is not a recognized MySQL file.