Database and Application Forensics Questions

This topic assesses skills for recovering and interpreting evidence stored at the application and database layers. Candidates should understand database internals such as transaction logs, binary and write ahead logs, and techniques for restoring or carving deleted records. Evaluation includes parsing application specific storage formats, reconstructing user actions from API and audit logs, handling cloud hosted and distributed databases, and coordinating with engineering to retrieve durable artifacts. Candidates should also discuss challenges such as replication, eventual consistency, and legal constraints around retention and privacy.