Retrieve Transaction Log as of a specific date

Pam Tedesco 5

Any direction as to how I can retrieve a transaction log for a laptop running Windows 11 Home on a laptop. Would like to get info that a general user can use to see info as of a specific date. Thanks!

MotoX80 35,596 Reputation points

2025-02-26T16:30:05.2233333+00:00

What do you mean by "Transaction Log"? For what application?

Are you referring to SQL Server?

https://learn.microsoft.com/en-us/sql/relational-databases/logs/the-transaction-log-sql-server?view=sql-server-ver16
Pam Tedesco 5 Reputation points

2025-02-26T17:16:29.63+00:00

Thanks for the request for clarification...clearly I'm not a techie :-)

I'm working on trying to identify if a significant number of files have been removed from a laptop during a specific time window. In other words, how much storage of files/documents were on the computer on X date vs on X date. Follow-up question would be if there is a large discrepancy, what avenues would I have to get any deleted files restored?

1 answer

MotoX80 35,596 Reputation points

2025-02-27T01:34:34.78+00:00

clearly I'm not a techie :-)

Do you know someone who is a techie who could help you with this if you need it?

You can enable file system auditing which will generate events when files get deleted (or added/changed). These events get written into the Security eventlog. That might not be the best medium for you to query for changes, but it can be done.

https://www.bing.com/search?q=how%20to%20enable%20windows%20file%20system%20auditing

For restoring files, you would first look to the recycle bin to see if the files are there. The problem with that is that not all file deletes are of the "send to recycle bin" variety. Some are straight deletes where the file is gone for good.

You would need to implement some form of Windows backup solution to make sure that you have the files backed up. There are a lot of ways to do that.

https://www.bing.com/search?q=windows+10+backup+solutions

Can you provide some more information on what you're trying to do? How many files you have in the main data folder? How much disk space do they occupy? How much free disk space is on this PC?

You may be able to implement a simple solution using existing Windows tools like robocopy and Powershell.
Please sign in to rate this answer.
Pam Tedesco 5 Reputation points

2025-02-27T01:50:23.4266667+00:00

I'm trying to do a layman's forensic study of a company computer - all files are gone....(Terminated) employee shrugs shoulders and says don't know what happened....they are there....but nowhere to be found.

MotoX80 35,596 Reputation points

2025-02-27T13:58:49+00:00

Do you know the names of any of the files? Or something unique in their names?

Open a command prompt with "run as administrator" and run this command. This should help find files that got moved or were hidden. You don't need to specify the full file name just a partial text string.

dir /b /s /a c:\*your-unique-name*

I have not used it, but I see that Microsoft has a File Recovery tool.

https://support.microsoft.com/en-us/windows/windows-file-recovery-61f5b28a-f5b8-3cc2-0f8e-a63cb4e1d4c4

You may need to attach an external drive to the PC as I see that it says that the source and destination drives must be different. As I recall, when a file gets deleted, it's entry in the master file table just gets flagged as deleted. The disk space that the file occupies is added to the free list but is not overwritten. But as time goes by any writes to the file system could overwrite the space occupied by deleted files. (So the process of restoring deleted files from the C: drive back to the C: drive could corrupt the files that you're trying to recover.)

MotoX80 35,596 Reputation points

2025-02-27T14:37:07.17+00:00

Did you check the recycle bin?

Pam Tedesco 5 Reputation points

2025-02-27T14:48:04.0733333+00:00

Yes. Recycle bin emptied, history gone, all account logins gone, tried a few restoration options (File Recovery, restore computer from an earlier date, etc.) to no avail.

MotoX80 35,596 Reputation points

2025-02-27T15:23:02.2666667+00:00

If the File Recovery tool didn't find anything, then you are probably out of luck.

https://www.howtogeek.com/680458/how-to-use-microsofts-windows-file-recovery-on-windows-10/

Pam Tedesco 5 Reputation points

2025-02-27T15:49:45.5866667+00:00

Let's consider this closed. All my attempts to retrieve have failed, however the files have "magically" reappeared overnight. Time to update some more passwords....

Thank you for your guidance!

MotoX80 35,596 Reputation points

2025-02-27T16:39:11.8+00:00

I don't know what type of organization/business this is, or what resources you have available to you, but if you have critical data files that you don't want to lose, then implementing some backup solution is imperative. Yeah, I know, thank you Captain Obvious.

Your biggest problem is probably going to be trying to convince management that yes, you have to spend money to protect yourself. We used to do periodic disaster recovery tests. Someone would pick a server and tell us; that server just went up in flames, now go recover the data.

You can do the same. Walk around to some pc and unplug it from the network. Ask your IT support to recover the data. If they can't, ask your management to put a price tag on lost employee productivity, lost sales revenue, lost intellectual property, etc.

All it takes is for one employee to open an email that contains ransomware to put you out of business.

Pam Tedesco 5 Reputation points

2025-02-27T19:26:51.07+00:00

Thanks! Lesson learned...Note taken!! We will SO be on that! Again, thank you for your guidance!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Retrieve Transaction Log as of a specific date

1 answer

Your answer