How to find who deleted data from my table in sql server - sql-server

Question

I have some table in my table which is accessible to many. Some data is missing in my table now. How can I find who deleted those rows from that table.

Answer 1

You can use ApexSQL Log to fully investigate operations executed against your table. The database needs to be in the full recovery model, so the information on past operations is available inside the transaction log file for ApexSQL Log to read it. Once the tool analyzes your t-log, you will be able to see the time the operation began and ended, the operation type, the schema and object name of the object affected, the name of the user who executed the operation, and more. For UPDATEs, you’ll even be able to see the old and the new value of the updated fields.
There are several guides on this here https://solutioncenter.apexsql.com/apexsql-log-solutions-table-of-contents/
Furthermore, you can even use ApexSQL Log to rollback those transactions if you need to. It will simply 'Undo' them and rollback changes back to their original state.

Answer 2

You can find deleted data's UserName by following little snippet :
DECLARE #TableName sysname
SET #TableName = 'dbo.t1_new' --INPUT TABLE NAME
SELECT
u.[name] AS UserName
, l.[Begin Time] AS TransactionStartTime
FROM
fn_dblog(NULL, NULL) l
INNER JOIN
(
SELECT
[Transaction ID]
FROM
fn_dblog(NULL, NULL)
WHERE
AllocUnitName LIKE #TableName + '%'
AND
Operation = 'LOP_DELETE_ROWS'
) deletes
ON deletes.[Transaction ID] = l.[Transaction ID]
INNER JOIN
sysusers u
ON u.[sid] = l.[Transaction SID]
source : dba.stackexchange
(I don't recall who posted it)

Answer 3

Unfortunately, you can't see deleted records if you don't keep them somewhere yourself.
If you want to track this type of interventions, you should not really delete your records.
Instead, you should create a some more fields on your table.
Here is an exemple :
SET QUOTED_IDENTIFIER ON
GO
SET ANSI_PADDING ON
GO
CREATE TABLE [dbo].[Person](
[Pers_ID] [int] IDENTITY(1,1) NOT NULL,
[Pers_CompanyID] [int] NULL,
[Pers_FirstName] [nvarchar](50) NULL,
[Pers_LastName] [nvarchar](50) NULL,
[Pers_CreatedBy] [int] NULL,
[Pers_CreatedDate] [datetime] NULL,
[Pers_UpdatedBy] [int] NULL,
[Pers_UpdatedDate] [datetime] NULL,
[Pers_Deleted] [bit] NULL,
CONSTRAINT [PK_Person] PRIMARY KEY CLUSTERED
(
[Pers_ID] ASC
)WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY]
) ON [PRIMARY]
GO
SET ANSI_PADDING OFF
GO
When the user creates a record, you can set CreatedBy = UserID, CreatedDate = CurrentDate,
While updating a record, UpdatedBy = UserID, UpdatedDate = CurrentDate
And deleting, Deleted = True, UpdatedBy = UserID, UpdatedDate = CurrentDate.
And in your code, in all queries you should add the condition Deleted = null.
Thus, you can track who created, updated or deleted a record.