How to use SQL logs to restore Data

Document directory

• Related Articles

How do I recover data from SQL Server's log files? There are several tools available for reviewing SQL server log files, and restoring data that was accidentally lost or too upted, say, after your last backup. Three such products are:
 
Apex SQL log
 
Log Explorer
 
SQL log rescue
 
What follows is the reason this article was written in the first place... A Big oops by yours truly, And a surprisingly easy procedure for turning that oops into a complete recovery (using lumigent's Log Explorer ).
 
Let's say I create a database called foobar, create a table called foo1, and populate the table with some fictitious data:
 

Set nocount on   Create Database foobar Go   Use foobar Go   Create Table foo1 ( Id int primary key, Relid int )   Set nocount on   Insert foo1 values (1, 1) Insert foo1 values (2, 5) Insert foo1 values (3, 3) Insert foo1 values (4, 2) Insert foo1 values (5, 7) Insert foo1 values (6, 9) Insert foo1 values (7, 4) Insert foo1 values (8, 5)

 
Now let's say I 've ve thrown away the table or file that showed me those relationships of ID <-> relid and allowed me to create the above insert statements. I 've also closed this query analyzer window, so I can't even recover the script I used to populate the table. (pretend, for a moment, that the script was too long to be memorized .)
 
So now, I want to update one row, and I open a new query analyzer window and say:
 

Update foo1 set relid = 5

 
After I hit F5, I realize: Oh dear, I forgot to add a where clause. I just updated all of the data in my table! I wasn't in a transaction, so I can't roll back. I don't have a backup, so I can't restore. What do I do?
 
Lumigent's Log Explorer that will allow you to easily parse SQL Server's logs and recover data after an irreparable event, such as a delete or update without a where clause, not within a transaction, and before a single backup has been completed MED.
 
So, I can open log explorer, select attach log file:
 
 
 
Then I can connect, and then I can select my database and attach:
 
 
 
Next, I want to move to filter log records so I can only show modify row statements:
 
 
 
If I move to browse/view log, you can see that I can scroll through my six update statements (Remember, two of them did not apply because the data didn't change ):
 
 
 
If I right-click and choose undo transaction, I will be presented with a set of reverse operations in a file called recovery. SQL. In this case, the output is as follows:
 

Update [DBO]. [foo1] Set [relid] = 4 where [ID] = 7 and [relid] = 5 Update [DBO]. [foo1] Set [relid] = 7 where [ID] = 5 and [relid] = 5 Update [DBO]. [foo1] Set [relid] = 2 where [ID] = 4 and [relid] = 5 Update [DBO]. [foo1] Set [relid] = 3 where [ID] = 3 and [relid] = 5 Update [DBO]. [foo1] Set [relid] = 1 where [ID] = 1 and [relid] = 5 Update [DBO]. [foo1] Set [relid] = 9 where [ID] = 6 and [relid] = 5

 
Now you can restore your data as it was, before the fat-fingered update statement!
 
Some further information about Log Explorer:
 
Log Explorer can read SQL Server's online transaction log and transaction log backup files on disk. there is no limit to the size or length of history in the logs, but the log backups must be SQL Server format on a disk Log Explorer can read.
 
Log Explorer can read the transaction log regardless of the recovery model (simple, bulk, or full ). however, if the recovery model is set to simple (truncate log on checkpoint on for SQL Server 7) Then SQL server can overwrite transactions in the log. if transactions are overwritten by SQL or for any other reason (e.g. A truncate operation) they do not exist, then Log Explorer obviusly cannot find them. so, bulk and full recovery models are recommended to ensure coverage by Log Explorer.
 
As you can see from some of the screenshots, there is a lot of functionality buried in Log Explorer. I highly recommend downloading the evaluation version and playing with it against pubs, to see how powerful it really is. related Articles

Are there tools available for auditing changes to SQL Server Data?
Can I create an index on a bit column?
Can I have optional parameters to my stored procedures?
Can I implement an input mask in SQL Server?
Can I make SQL Server format dates and times for me?
Can I start identity values at a new seed?
Can SQL Server tell me which row was inserted most recently?
How can I learn more about uninitialized ented SQL server stored procedures?
How can I make my SQL queries case sensitive?
How do I audit changes to SQL Server Data?
How do I connect to a non-default instance of SQL Server?
How do I connect to SQL server on a port other than 1433?
How do I create a cross-tab (or "Submit") query?
How do I determine if a table exists in a SQL Server database?
How do I drop a SQL Server database?
How do I find all the available SQL servers on my network?
How do I get a list of SQL Server tables and their row counts?
How do I get rid of Named Pipes/dbnmpntw errors?
How do I get the correct date/time from the MSDB. sysjob * tables?
How do I get the nth row in a SQL Server table?
How do I get the result of dynamic SQL into a variable?
How do I handle Replace () within an ntext column in SQL Server?
How do I hide system tables in SQL Server's Enterprise Manager?
How do I know which version of SQL Server I'm running?
How do I limit the number of rows returned in my resultset?
How do I load text or CSV file data into SQL server?
How do I manage changes in SQL Server objects?
How do I monitor SQL server performance?
How do I prevent linked server errors?
How do I reclaim space in SQL Server?
How do I search for special characters (e.g. %) in SQL Server?
How do I start SQL Server Agent from asp?
How do I time my T-SQL code?
How do I upsize from access to SQL server?
How do I upsize my MSDE database to full-blown SQL Server 2000?
How do I use a variable in a top clause in SQL Server?
How do I use getdate () within a user-defined function (UDF )?
How can I store an IP address in SQL Server?
Schema: How do I find all the foreign keys in a database?
SQL Server & MSDE
What are reserved access, ODBC and SQL Server keywords?
What are the capacities of access, SQL Server, and MSDE?
What are the main differences between access and SQL server?
What do I need to know about SQL Server 2000 SP4?
Where else can I learn about SQL server?
Where is the SP4 for SQL Server 2000?
Why am I having problems with SQL Server 2000 sp3/sp3a?
Why can't I Install SQL Server on Windows Server 2003?
Why can't I Install SQL Server on Windows XP?
Why can't I use like '% datepart % 'queries?
Why do I get "Login Failed for user '/'."?
Why do I get 'object cocould not be found 'or 'invalid object name '?
Why do I get errors about Master... spt_values?
Why do I get script errors in Enterprise Manager's 'taskpad 'view?
Why do I get sqlsetconnectattr failed errors?
Why do I have problems with views after altering the base table?
Why does em crash when I get an error in a stored procedure?
Why does Enterprise Manager return 'invalid cursor state '?
Why does my Delete query not work?
Why does sp_spaceused return inaccurate values?
Why is Enterprise Manager slow at expanding my database list?
Why is my app slow after upgrading from SQL Server 7 to 2000?
Why is tempdb full, and how can I prevent this from happening?
Why shoshould I consider using an auxiliary calendar table?
Why shoshould I consider using an auxiliary numbers table?