SQL Server Forensic Analysis

5. SQL Server Investigation Preparedness

Forensic practitioners routinely arrive on the scene of a potential security incident tasked with the job of piecing together what, if any, crime has occurred. In these situations, in addition to overcoming challenges surrounding piecing together incident events, investigators are in a race against the clock to quickly preserve key data that may prove critical to their investigation. SQL Server forensic investigations are no different: Seconds and minutes count, and the speed with which the investigator moves can play a critical role in determining whether data critical to an investigation is preserved or lost. To help you remain as efficient as possible during a database investigation, you should ...