9. Artifact Analysis II
This chapter is a continuation of Chapter 8’s view of artifact analysis. Artifact analysis is a large topic and, therefore, is split into two chapters in this book. Chapter 8 focused on authentication and authorization, and configuration and versioning artifact analysis. In this chapter, we focus on the analysis of activity reconstruction and data recovery artifacts.
Throughout a database investigation, the command-line SQLCMD client is used to identify and collect SQL Server artifacts. During artifact analysis, we can set aside this command-line tool and use the trusted SQL Server Management Studio GUI and related tools to analyze the collected artifacts.
Working Along with Chapter 9 Examples