Audit whether stored proc was executed - in the transaction logs

Question

We have SQL Server 2005 database with full backup and transaction logs. We have a problem with the database - and need the SQL CSI Forensic team to help.

Is there a way to look at the transaction logs and identify whether a stored procedure was executed? We know the time that it happened (if it happened) but there is a dispute whether it happened.

Any suggestions. I know we should have been logging - we are obviously thinking about this now.

Answer 1

For updating & deleting data you may be able to figure out what happened using DBCC LOGINFO There are products like apex sql log that will make this analysis much easier. THis will tell you when it happened, but not what user made the call. Although you make have other application level logs (iis logs for example) that may help in this respect.

For selecting or looking at data i'd say you have no chance.

In future if you need this kind of audit trail i suggest you look at SQL's C2 Auditing feature.