Where MSSQL Database Logs Are Stored
Short answer
C Joshua should inspect Model.ldf, the MSSQL transaction log file, for records of transactions and database modifications revealing the attack.
Question
Key Takeaways
The question tests knowledge of SQL Server file extensions: .ldf is the transaction log file that holds the audit-relevant record of database modifications, while .log, .txt and .lgf are decoys.
When hunting for attack evidence in an MSSQL database, an examiner must locate the transaction log, which records every change made to the database. The correct file is Model.ldf, the SQL Server transaction log file, alongside the Model.mdf data file.
Common mistake: Learners often pick Model.log because the word 'log' appears in the option, but SQL Server does not use a .log extension for its transaction log; the format is .ldf (Log Database File).
Expert Analysis
Why the Answer Is Correct
SQL Server databases are composed of primary data files (.mdf), optional secondary files (.ndf), and transaction log files (.ldf). The transaction log records every transaction and each data modification, making it the primary source of database-level attack evidence such as unauthorized INSERT, UPDATE or DELETE statements. For a database named Model, the log file is Model.ldf, so option C is correct, and as aqeel1506 explained, "The.ldf file is the transaction log file for an MSSQL database" containing all transactions and modifications.
Why the Other Options Are Wrong
Model.log and Model.txt are not SQL Server file types; SQL Server never writes its transaction history to a plain.log or.txt file, so those extensions are simply plausible-sounding decoys. Model.lgf does not exist in any SQL Server naming convention and is fabricated for this question. As Elb summarized, "SQL Server stores data and logs in Primary Data Files (MDF), Secondary Data Files (NDF) and Transaction Log Data Files (LDF), respectively," which rules out every extension except.ldf.
Community Comment Notes
The community unanimously chose C with 100 votes, and the comments correctly identify the.ldf file as the transaction log holding recovery and audit information. Elb's note further distinguishes MDF, NDF and LDF roles, confirming that LDF "stores log related information that can be used to recover databases." No comment disputes the answer, so there is full alignment between the comments and the technical facts.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
Memorize the SQL Server file triad: .mdf (data), .ndf (secondary data), .ldf (transaction log). In forensics questions, the transaction log is where tampering and attack traces surface, so always choose the .ldf option when logs are requested.
Frequently Asked Questions
Why isn't Model.log the correct file for MSSQL database logs?
What evidence can an examiner find in Model.ldf?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Elb 👍 1 Answered CThe SQL Server stores data and logs in Primary Data Files (MDF), Secondary Data Files (NDF) and Transaction Log Data Files (LDF), respectively. MDF is the starting point of a database; it stores user data and database objects NDF is optional and spreads data across multiple databases LDF stores log related information that can be used to recover databases. These are divided into smaller parts called virtual log files.
-
aqeel1506 👍 1C. Model.ldf The .ldf file is the transaction log file for an MSSQL database and contains a record of all the transactions and the database modifications made by each transaction.
-
Elb 👍 1C < Log Database File
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.