9. Artifact Analysis II

This chapter is a continuation of Chapter 8’s view of artifact analysis. Artifact analysis is a large topic and, therefore, is split into two chapters in this book. Chapter 8 focused on authentication and authorization, and configuration and versioning artifact analysis. In this chapter, we focus on the analysis of activity reconstruction and data recovery artifacts.

Throughout a database investigation, the command-line SQLCMD client is used to identify and collect SQL Server artifacts. During artifact analysis, we can set aside this command-line tool and use the trusted SQL Server Management Studio GUI and related tools to analyze the collected artifacts.

Working Along with Chapter 9 Examples

Artifact ...

Get SQL Server Forensic Analysis now with the O’Reilly learning platform.

O’Reilly members experience live online training, plus books, videos, and digital content from nearly 200 publishers.