Where MSSQL Database Logs Are Stored
Joshua is analyzing an MSSQL database for finding the attack evidence and other details, where should he look for the database logs?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of SQL Server file extensions: .ldf is the transaction log file that holds the audit-relevant record of database modifications, while .log, .txt and .lgf are decoys.
When hunting for attack evidence in an MSSQL database, an examiner must locate the transaction log, which records every change made to the database. The correct file is Model.ldf, the SQL Server transaction log file, alongside the Model.mdf data file.
Learners often pick Model.log because the word 'log' appears in the option, but SQL Server does not use a .log extension for its transaction log; the format is .ldf (Log Database File).
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
SQL Server databases are composed of primary data files (.mdf), optional secondary files (.ndf), and transaction log files (.ldf). The transaction log records every transaction and each data modification, making it the primary source of database-level attack evidence such as unauthorized INSERT, UPDATE or DELETE statements. For a database named Model, the log file is Model.ldf, so option C is correct, and as aqeel1506 explained, "The.ldf file is the transaction log file for an MSSQL database" containing all transactions and modifications.Why the Other Options Are Wrong
Model.log and Model.txt are not SQL Server file types; SQL Server never writes its transaction history to a plain.log or.txt file, so those extensions are simply plausible-sounding decoys. Model.lgf does not exist in any SQL Server naming convention and is fabricated for this question. As Elb summarized, "SQL Server stores data and logs in Primary Data Files (MDF), Secondary Data Files (NDF) and Transaction Log Data Files (LDF), respectively," which rules out every extension except.ldf.Community Comment Notes
The community unanimously chose C with 100 votes, and the comments correctly identify the.ldf file as the transaction log holding recovery and audit information. Elb's note further distinguishes MDF, NDF and LDF roles, confirming that LDF "stores log related information that can be used to recover databases." No comment disputes the answer, so there is full alignment between the comments and the technical facts.Official Reference
Exam Strategy
Memorize the SQL Server file triad: .mdf (data), .ndf (secondary data), .ldf (transaction log). In forensics questions, the transaction log is where tampering and attack traces surface, so always choose the .ldf option when logs are requested.
Frequently Asked Questions
Why isn't Model.log the correct file for MSSQL database logs?
SQL Server does not use a .log extension; its transaction log is stored in a .ldf file, so Model.log is a decoy option.
What evidence can an examiner find in Model.ldf?
The .ldf transaction log records every transaction and data modification, exposing unauthorized queries and changes made during an attack.