Digital Forensics in Small Devices: RFID Tag Investigation

4.2.3.6.5 SQL Server Error Logs
Usually, the SQL Server 2005 preserves seven error logs which are useful for
determining the information related to authentication, whether successful or
failed login attempts to the SQL Server. By default, the server error logs were
located in the same directory as that of trace files (C:\Program Files\Microsoft
SQL Server\MSSQL.1\LOG) and the current error log was acquired by using
the following syntax:
dcfldd conv= noerror if=“C:\Program Files\Microsoft SQL
Server\MSSQL.1\MSSQL\LOG\ERRORLOG” of=E:\errorlog hash=md5 hashlog=E:\
errorlog.md5
Similarly, the rest of the error logs were also acquired by using dcfldd tool for
investigation purpose (Figure 4.52)
Figure 4.52: Acquisitions of backend SQL Server error logs by using dcfldd tool
120