Forensic examination of Sql Server 2000 database
javif
Posts: 2
I´m a forensic examinator. I have a case with a Sql server 2000 database and I´m searching for old transactions. The database is in simple recovery model. I use SQL Log Rescue and I found a lot of transactions.
Now to present the case in court I have to obtain the same results through queries. I use "Select * from ::fn_dblogs" but I can obtain just the active portion of the log file. In Sql Server 2005 I can use DBCC TRACEON(2537) to read all the log file, but it doesn´t work in Sql Server 2000.
Does anybody know how SQL Log Rescue read all the log file (active and inactive) portion or if is there any way to do it through queries?
Thanks in advance
Now to present the case in court I have to obtain the same results through queries. I use "Select * from ::fn_dblogs" but I can obtain just the active portion of the log file. In Sql Server 2005 I can use DBCC TRACEON(2537) to read all the log file, but it doesn´t work in Sql Server 2000.
Does anybody know how SQL Log Rescue read all the log file (active and inactive) portion or if is there any way to do it through queries?
Thanks in advance
