Digital Forensics in Small Devices: RFID Tag Investigation

SQL Server events can be identified. Hence, the following syntax was used to
acquire the ring buffer data.
:out E:\RingBuffer.txt
SELECT * FROM sys.dm_os_ring_buffers
GO
The fragment of acquired ring buffer data out was as shown in the Figure 4.23.
Figure 4.23: Fragment of Ring Buffer data results from sys.dm_os_ring_buffers
The notable results included not only the timestamp of each buffer entry, but
also the record of the SQL Server events.
Furthermore, the acquisition of the ring buffer security error was also
essential as in order to determine login failures and events related to the
security. Thus, the following syntax was used to acquire the security related
errors.
:out E:\RingBuffers.txt
SELECT * FROM sys.dm_os_ring_buffers WHERE ring_buffer_type =
„RING_BUFFER_SECURITY_ERROR‟
GO
97