SQL Server Forensics

SQL Server Forensics by Thegrideon Software is an advanced tool for MS SQL Server database files (.mdf, .ndf) analysis, review, data recovery and export as well as password replacement. It works with files directly without any external database engines and designed to provide read-only access to all SQL Server Tables / Rows. Functions, Procedures, Triggers and Views are displayed with SQL code syntax highlighting and "WITH ENCRYPTION" decoding. All versions from 7 / 2000 up to the latest MS SQL Sever 2022 are supported.

Trial installer
2022.07.07
3 Mb / .exe

Trial portable
2022.07.07
3 Mb / .zip

Buy License Key »
Price: 99 USD per PC
including one year of free support

SQL Server Forensics Features:

Direct read-only access to SQL Server database files (.mdf, .ndf):

lists all database tables;
shows schemas (columns names, types, sizes, etc);
internal table viewer is available for preliminary analysis;
row structure is displayed and raw bytes can be examined.
tables can be exported as RFC 4180 CSV files for BULK INSERT;
bulk export is available;
special non-ANSI encodings are supported;
internal hex viewer is available for attached binary or large text blocks;
binary and large data blocks can be extracted as well;
SQL code viewer with syntax highlighting;
automatic WITH ENCRYPTION code decryption;

File is scanned for abandoned data pages (deleted tables, old allocations, ...)
All data pages are scanned for recoverable (deleted, lost) records.
Lists active database Logins in master database.

user passwords hash can be replaced instantly.
hash value export and import is available for temporary replacement.

Pure Win32 API design - no additional libraries or frameworks to install.
Windows 7 - Windows 11.

Program Screenshots:

sql code preview master database logins

Data Access, Analysis, Review, Export and Recovery:

SQL Server Forensics is designed to provide full direct access to all Tables / Rows saved in SQL Server database (.mdf, .ndf).It is based on reverse-engineering of database format and works with files directly without any database engines / libraries.Data is not changed in any way and can be accessed or extracted repeatedly in contrast to standard access methods.SQL Server database tables can be previewed for preliminary analysis and / or exported as RFC 4180 compliant csv files to be used in BULK INSERT query or in MS Access, Excel, etc. Attached binary and text blocks of data can be previewed in internal Hex viewer or extracted for further analysis. Functions, Procedures, Triggers and Views are available for review with syntax highlighting and automatic WITH ENCRYPTION decoding.SQL Server Forensics also searches and recovers old records / discarded data pages with old or deleted data. It is not a repair tool, but direct database records access allows data recovery from irreparable files in many cases.

Trial Version Limitations:

Trial version is available to check format compatibility. It allows you to view and search through odd rows from any table and preview data (SQL, etc.) from objects with odd IDs. Export is enabled for "sys..." tables only. Master database password replacement feature is disabled.