Forum Post: RE: DB user got deleted

Hi Karthick,

If the transaction log of your SQL-NAV-Database still exists you can run the following statement to see the "delete" tracking of your User table. Unfortunately you cannot see directly which data has been deleted as this is stored in binary form within the Transaction Log. If you need this Information in addition you can ask your SQL Server Admin to analyze the Row Content in detail for further Information which content has been deleted.

SELECT deletes.AllocUnitName,deletes.Operation,l.[Begin Time],u.name
   FROM fn_dblog(NULL, NULL) l
INNER JOIN ( SELECT [Transaction ID],AllocUnitName,[RowLog Contents 0],Operation
                          FROM fn_dblog(NULL, NULL) deletes2
                       WHERE (AllocUnitName = 'dbo.User.User$0'                 -- Database Login 
                               OR AllocUnitName like 'dbo.$ndo$usrproperty%')   -- Windows Login
                             AND Operation = 'LOP_DELETE_ROWS') deletes ON deletes.[Transaction ID] = l.[Transaction ID]
INNER JOIN Master..sysusers u ON Convert(varchar(64),u.[sid],1) = Convert(varchar(64),[Transaction SID],1)
WHERE l.Operation = 'LOP_BEGIN_XACT';

But for your purpose it should fit to see when the user table has been touched for deletion and which user run the statement. For analyzing the binary content here´s an additional link:

rusanu.com/.../how-to-read-and-interpret-the-sql-server-log

Best regards,

Tobias