How I Recovered Deleted SQL Server Rows Without Ever Enabling CDC or Audit
Most data-recovery tools assume you turned on Change Data Capture, Change Tracking, or Audit before the incident happened. In the real world — small and mid-sized companies running their own SQL Server — almost nobody does that. By the time someone notices bad data, it's already too late to turn those features on retroactively. SQL Server's transaction log already records every change. The…
The article recounts how the author developed LogCarver, a tool to recover deleted SQL Server rows without enabling Change Data Capture, Change Tracking, or Audit. Most recovery tools assume these features were enabled beforehand, but in small and mid-sized businesses, this is rarely the case. SQL Server's transaction log already records every change, but the fn_dblog function that reads it is rarely used and its row image byte layout isn't published.
The author reverse-engineered the format from actual output, byte by byte, leading to the creation of LogCarver. Two bugs were discovered after releasing the tool: one affecting Heap tables and another caused by extra indexes. Debugging the issue required connecting to a live database and examining fn_dblog's raw output. The fix involved querying sys.indexes for the table's storage structure and building the exact AllocUnitName from that, instead of guessing string patterns.
All three bugs were only found by testing on actual SQL Server instances, not by relying on documentation or intuition. The current limitations of LogCarver include handling specific data types and TRUNCATE TABLE operations.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
