SQL Server Data File for Deleted Data Recovery

312-49v10 By islever Editorial Last updated

Investigating Web Attacks

Short answer

B Focus on the LDF file because it holds the transaction log information required to reconstruct and recover deleted database data.

Question

There's a digital forensics investigator delving into a case right now. The situation involves an SQL Server database that's been tampered with by an intruder. Some data from the database has vanished, and the real kicker is that there aren't any backup files to be found. The investigator's task is to recover as much data as possible. The investigator needs to understand which SQL Server data file will most likely assist in the data recovery. What should be the investigator's primary focus?
  1. Page Header because it contains metadata about the page like page ID, page type
  2. LDF because it holds the log information associated with the database Correct Answer
  3. MDF because it stores all data in the database objects
  4. NDF because it can store additional data separate from the primary data file

Key Takeaways

This question tests SQL Server database forensics and the common trap is assuming the primary data file (MDF) is the best source for recovery when the transaction log (LDF) actually contains the transaction history needed to reconstruct deleted records.

When an intruder deletes data from an SQL Server database and no backups exist, forensic investigators must target the transaction log file to recover the lost data. This page establishes that the LDF file is the primary focus because it records all database transactions, including the data needed for recovery.

Common mistake: Choosing MDF (Option C) because it stores the primary data objects, but deleted data is often overwritten or marked as ghost records, whereas the LDF retains the transaction log details necessary to reconstruct the deleted data.

Expert Analysis

Why the Answer Is Correct

The LDF (Log Data File) is the correct answer because it stores the transaction log information for the SQL Server database. In the event of data deletion without a backup, the transaction log records all committed transactions, including the before-images of deleted rows, allowing forensic investigators to reconstruct and recover the vanished data.

Why the Other Options Are Wrong

The MDF (Primary Data File) stores the actual database objects, but deleted records are typically marked as ghost records and can be quickly overwritten by the SQL Server engine, making it an unreliable primary source for recovery. The NDF (Secondary Data File) merely holds additional data offloaded from the primary file and suffers from the same overwrite limitations as the MDF. The Page Header only contains metadata about the page structure, such as page ID and type, and does not contain the actual transactional data needed to restore missing rows.

Community Comment Notes

The community correctly identifies the LDF file's purpose, noting that "A transaction log file helps a forensic investigator in examining the transactions" and can recover deleted data. As Elb noted, the LDF holds the log information associated with a database, which is critical when backups are unavailable.

Official Reference

https://learn.microsoft.com/en-us/sql/relational-databases/databases/database-files-and-filegroups

This link opens the official vendor documentation in a new tab.

Exam Strategy

For SQL Server forensic questions involving data recovery without backups, always look for the transaction log file (LDF) as it records the transaction history. Do not default to the primary data file (MDF) unless the question specifically asks about carving unallocated or ghost records rather than transactional recovery.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Elb 👍 1 Answered B
    The transaction log data files (LDF) hold the log information associated with a database. A transaction log file helps a forensic investigator in examining the transactions that occur in a database and recover the deleted data, if required. The file name extension for the transaction log date files is .ldf and each file is divided into multiple virtual log files.
  2. Elb 👍 1
    B < https://www.papercut.com/kb/Main/LogFileSizeOnSqlServer/#:~:text=The%20LDF%20file%20is%20the,from%20the%20transaction%20log%20file.
  3. 4bd3116 👍 1 Answered B
    Log data file (LDF)

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Analyzing Password-Protected Packed Malware

S-grade

Steganalysis for Steganography Attack Detection

S-grade

File Sector Allocation and Fragmentation in Forensics

S-grade

Which Tor Relay Should Investigators Focus On to Trace Data Origin?

S-grade

← Back to 312-49v10 Study Guide