Forensic examination of Sql Server 2000 database

Undo for SQL Server.

Forensic examination of Sql Server 2000 database

Postby javif » Fri Jul 11, 2014 1:42 am

I´m a forensic examinator. I have a case with a Sql server 2000 database and I´m searching for old transactions. The database is in simple recovery model. I use SQL Log Rescue and I found a lot of transactions.

Now to present the case in court I have to obtain the same results through queries. I use "Select * from ::fn_dblogs" but I can obtain just the active portion of the log file. In Sql Server 2005 I can use DBCC TRACEON(2537) to read all the log file, but it doesn´t work in Sql Server 2000.

Does anybody know how SQL Log Rescue read all the log file (active and inactive) portion or if is there any way to do it through queries?

Thanks in advance
Posts: 1
Joined: Fri Jul 11, 2014 1:33 am

Return to SQL Log Rescue

Who is online

Users browsing this forum: No registered users and 0 guests