Automatically generated based on tag:
| Title | Type | Summary | Location |
|---|---|---|---|
| Microsoft SQL Server | Page | Microsoft SQL Server is a relational database engine. Each installed instance maintains its own set of databases, log files, and optional auditing outputs under the instance data directory. The following SQL Server–specific sources are of forensics interest: - Database files (master, msdb, model, and user databases): principals, roles/permission definitions, linked servers, and job configured. - Transaction logs: for data changes since last database checkpoint. - SQL Server error logs (ERRORLOG): engine lifecycle events, enabling or disabling of features (such as sp_configure), and login failures. - SQL Trace (.trc files) and SQL Server Profiler: event tracing framework, that provide granular control over events/fields collection and event filtering events. Intented to for operationnal monitoring/troubleshooting and replaced by Extended Events. A "default trace" is enabled by default on every instance and captures a small amount of built-in history about significant instance activity. - Extended Events/XEvents sessions (.xel files): event tracing framework that replaces SQL Trace. Extended events provide similar granular control over the events and event fields that will be logged. Not enabled by default. - SQL Server Audit (.sqlaudit files and/or EVTX events 33205 / 33206): security logging framework, built on top of Extended Events. Not enabled by default. - SQL Server Agent log files and the msdb database, for scheduled job execution and backup metadataz |
Default instance location: %ProgramFiles%\Microsoft SQL Server\<MAJOR_VERSION>\<INSTANCE_NAME>\MSSQL\. System and user database files: <INSTANCE_FOLDER>\MSSQL\DATA\. Log files: <INSTANCE_FOLDER>\MSSQL\Log\. System databases: master.mdf, msdb.mdf, and model.mdf. Transaction log: .ldf files. Error log: ERRORLOG, ERRORLOG.1, ... Windows event log: Channel: Application. Events: 18456, 15457, 18454, etc. (sources MSSQLSERVER/MSSQL$<INSTANCE>/SQLSERVERAGENT). SQL Trace (target dependant): .trc files. Default trace: log_<N>.trc. Extended Events (target dependant): binary .xel files. SQL Server Audit (target dependant): binary .sqlaudit files and/or Windows event Application / Security 33205/33206. SQL Server Agent log: SQLAGENT.OUT (and numbered archives). |
View on GitHub