In this post, I am sharing few steps to find out the transactions history for drop commands which executed in SQL Server.

There are many features for auditing and check the logging in SQL Server, but you can also directly read the transaction log and can get the necessary details.

Please check the below full demonstration of this:

Create a sample database and use it:

CREATE DATABASE Drop_Test
GO
USE Drop_Test
GO

CREATE TABLE tbl_Test (ID INT)
GO

SELECT OBJECT_ID ('tbl_Test')
GO

--tbl_Test object id: 581577110

DROP TABLE tbl_Test
GO

SELECT [Transaction Id], [Begin Time], SUSER_SNAME ([Transaction SID]) AS [User]
FROM fn_dblog (NULL, NULL)
WHERE [Transaction Name] = 'DROPOBJ'
GO

-- The Result:
/*
Transaction Id Begin Time User
-------------- ------------------------ ---------
0000:00000335 2017/04/25 17:53:41:187 Anvesh
*/

SELECT [Transaction Id], [Begin Time], SUSER_SNAME ([Transaction SID]) AS [User]
FROM fn_dblog (NULL, NULL)
WHERE [Transaction Name] = 'DROPOBJ'
GO

-- The Result:
/*
Transaction Id Begin Time User
-------------- ------------------------ ---------
0000:00000335 2017/04/25 17:53:41:187 Anvesh
*/

In the previous post, I shared the importance of LSN for all the database backup files of the SQL Server.

When we have different transaction backup data, sometimes it is required to check LastLSN and FirstLSN of those files.

If LSN sequence is not proper, then we cannot restore all database files in the series, and it generates an error like, LSN doesn’t match with the previous file.

Below are few different scripts to find LSN information of the Database Backup Files.

Using backupset table:

SELECT	 
	database_name
	,backup_size
	,first_lsn
	,last_lsn
	,checkpoint_lsn
	,database_backup_lsn
	,database_creation_date
	,backup_start_date
	,backup_finish_date	
FROM msdb.dbo.backupset

Using sys.database_recovery_status:

SELECT 
	last_log_backup_lsn
FROM sys.database_recovery_status
WHERE database_id = DB_ID()

Using fn_dblog():
It returns all information about the log data, and it contains two parameters, first is starting LSN and the second is ending LSN.
You can pass NULL for all the records.

SELECT 
	last_log_backup_lsn
FROM sys.database_recovery_status
WHERE database_id = DB_ID()

Using Restore with HeaderOnly option:
You can specify file name and path of the backup files, and it returns all information related to that backup file.

RESTORE HEADERONLY FROM DISK = 'C:\Temp\MyFull.bak'
RESTORE HEADERONLY FROM DISK = 'C:\Temp\MyTran01.trn'

SQL Server provides different types of database auditing option like: CDC, Database Audit.
Recently, I have shared one article about, change your database DDL changes using Encrypted DDL triggers.

SQL Server: Encrypted DDL Trigger to Track all Database Changes

Database Administrators are responsible for database security and Periodically, They have to track all the database related changes and make sure that everything is working fine.

But still sometimes, I used to track database changes from the SQL Server log files using fn_dblog().
I am sharing one way to find a person who dropped a table and also can get the name of that dropped table without enabling any auditing option of SQL Server.

Script to find the log of dropped objects:

Using this script, you can find a list of dropped tables and login name information, but you cannot get table name directly.
You can find the transaction id for each record and using this transaction ID, you can find the table name.

SELECT 
	[Transaction Id]
	,[Begin Time]
	,SUSER_SNAME ([Transaction SID]) AS [LoginName] 
FROM fn_dblog (NULL, NULL)  
WHERE [Transaction Name] = N'DROPOBJ';

Find Table name using TransactionID:

SELECT TOP 1 
	[Lock Information] 
FROM fn_dblog (NULL, NULL)  
WHERE [Transaction Id] = '0000:0015d6b3'  
AND [Lock Information] LIKE '%SCH_M OBJECT%';

The result:
To get the table name, you can copy the number and search into sys.objects table.

HoBt 0:ACQUIRE_LOCK_SCH_M OBJECT: 8:1015674666:0

Find your dropped table:
Please do not start to search your dropped table in your current database because Table already dropped.
You must restore the last backup of the database and you should search your dropped table in that database.

SELECT *FROM sys.objects 
WHERE Object_ID ='1015674666'