none
SQL Transaction Logs Analysis RRS feed

  • Question

  • Hello everyone,

    This is my first time posting in this forum so I apologize if I'm posting this in the wrong group.

    A little background on my question - We were asked to analyze the transactions logs of a database to determine who and when changes were made to the database. We have an idea of what information was changes, we just need to provide evidence of the person who did it. We were given an MDF and LDF file.

    I've tried using ApexSQL and Systool Log Analyzer to analyze the transaction logs but no luck (ApexSQL doesn't work and Systool Log Analyzer is only giving me 3 transactions. I believe there is more information in the transaction logs). I've spun up a local SQL server and attached the database by going to Object Explorer > Right-clicking on "Databases" > Attach. I did this so I can query the transaction logs that way. However, it appears to be only giving me data from when I attached the database and newer. See my query below: 

    ```SELECT
    Operation], [Transaction Name], [Begin Time], [Transaction SID],
    SUSER_SNAME ([Transaction SID]) AS [WhoDidIt?]
    FROM fn_dblog (NULL, NULL)
    WHERE [Operation] = N'LOP_BEGIN_XACT'
    GO

    ```

    My question is: how can I query the LDF file I was given? Anything I'm doing wrong?

    Thanks in advance for your help!

    Jorge

    Wednesday, January 15, 2020 8:39 PM

All replies