Find specific transaction in SQL differential backup

Question

We have a MSSQL server that is backed up daily with a full backup at 0000 and with a compressed differential backup every 15 minutes from 0010. Between Aug 10 and 11 our site was hacked and all data from one table was deleted (table was not dropped). We would like to figure out the exact time and transaction that deleted the table.

We managed to do restores of the db using the differential backups so now we have it narrowed down to a 15 minute period but do not know how to proceed from there.

Answer 1

In short, if you don't have transaction log backups, you don't have this information available.

Elaborating a little, differential backups are the net effect of all transactions since the last full backup. Specifically, differentials don't keep track of individual transactions. To check if you have any log backups at all, check the recovery model of your database. If it's "simple", there's no way that you do. If it's not simple, query the backup tables in msdb to find where the log backups are. From there, you will have to find a way to read the log backup. I'd suggest fn_dump_dblog. You can read about it here .