53

I mistakenly deleted around 2,000,000 records from a remote SQL Server 2008 table. The server is not granting me access to the backup files on the server side.

Is there any way to get back these records?

Improve this question
2
  • 18
    When's the last time you tested your backups?
    – Joe
    Commented Jan 31, 2011 at 13:49
  • 20
    When's the last time you tested a RESTORE of your backups?
    – datagod
    Commented Nov 23, 2011 at 16:22

3 Answers 3

Reset to default
125

Is your database in full recovery mode?

  • If yes, are you doing transaction log backups?

    • If yes, do you have a backup utility like Quest LiteSpeed, Red Gate SQL Backup, or Idera SQLSafe?
      • If yes, those utilities can undelete objects from backup files (including the fulls and transaction logs) - but explaining how to use those is beyond the scope of what I can do here. Contact the vendor for instructions.
      • If no, restore the full backup and transaction logs as a database with a different name. (Don't overwrite the existing database.) You'll be able to get an up-to-the-second copy of the object before the delete happened, but you'll need to use the stopat part of the restore command to specify when to stop restoring the commands. You need to stop before the delete happened.
    • If no, go grab a copy of a log reader utility like Quest LiteSpeed or Apex SQL Log. These utilities can connect to the database server, examine the log file, and help you undo transactions. I'm not sure if the demo versions will work, but the paid ones definitely will.

  • If no (not in full recovery mode), restore the last full backup as a database with a different name. (Don't overwrite the database you've already got.) From there, you'll be able to restore whatever records were online at the time of the backup, but you'll lose all of the changes since.

Improve this answer
3
  • 4
    Great answer, I will add that if you have auditing or change tracking it is usually easiest to get the data back from those those tables when only one table has been affected. And of course, if your answer was no to some or all of the above, after you restore the records as much as they can be, then fix your backup process and possibly who has access to production data.
    – HLGEM
    Commented Mar 20, 2012 at 18:37
  • If you're in simple mode, the rows might still be physically present on some pages. Maybe some of them can be recovered (at very high time and/or money cost).
    – usr
    Commented Sep 30, 2013 at 15:52
  • FYI. ApexSQL Recover besides the time limitation, the evaluation version recovers only 1 out of every 10 rows of the total rows available for recovery (apexsql.com/faqs/faqs_recover.aspx)
    – Sameer Alibhai
    Commented Nov 18, 2014 at 22:17
32

SQL Server keeps logs for each deleted record. You can query these logs via the fn_dblog SQL Server function.

SELECT [RowLog Contents 0] 
FROM   sys.fn_dblog(NULL, NULL) 
WHERE  
       AllocUnitName = 'dbo.TableName'        
   AND Context IN ( 'LCX_MARK_AS_GHOST', 'LCX_HEAP' )        
   AND Operation in ( 'LOP_DELETE_ROWS' )   
;

But this log is in Hex format and you need to convert this Hex format to your actual data.

The article below will help you recover the deleted records in the way defined above:

How to recover deleted data from SQL Server

Improve this answer
3
  • 3
    This is pretty cool. Under what conditions does this approach work (or not work)?
    – Nick Chammas
    Commented Nov 23, 2011 at 17:16
  • 3
    @NickChammas - It can only recover what is in the active log so for simple recovery model a checkpoint must not have occurred. Also it currently looks like it does not work correctly in databases with snapshot isolation but that should be an easy fix. @user1059637 - What is your attitude to people adding functionality to your code?
    – Martin Smith
    Commented Nov 24, 2011 at 13:27
  • @MartinSmith , Now it is working perfect with snapshot isolation as well.
    – user1059637
    Commented Nov 29, 2011 at 7:36
23

Unfortunately, we are not going to be able to help you without a lot more information. But from your question, I see that you have deleted what appears to be 2 million records from your database. Most likely you can't recover this information, unless you have full logging on your database and you purchase some very specific tools.

If you can describe in more detail just what it is you think you've done, and why you feel you can't get the records back, and can describe the organization of your database, then we might can help you a little more.

Some general advice: if you think you've deleted 2 million records, you're probably a little freaked out right now. So you should take a five minute break, calm down, and revisit the problem. Also, you should tell your boss right away if it's reasonable (don't wake someone up at 2am to tell them) and that you are working on a solution. Better to admit what's happened than to frantically try to recover and potentially make matters worse and hide the details. Knowing that your boss can help in some way, helps you fix the problem. Like I said, just some general advice.

Improve this answer
1
  • 11
    good idea with the 5 minute break. Always works. Helps to focus. :-) Been there done that.
    – John K. N.
    Commented Nov 19, 2012 at 15:29