master is a bit of a pain.
I assume you are just trying to recover the definition?
I just tried creating a logon trigger, backing up master and opening the *.bak file in notepad and searching for "CREATE TRIGGER" - it was plainly visible in the file.
Alternatively you could restore it as a regular user database (assume
master2 below) and see if the following finds it (will need to connect via the DAC)
CAST(imageval AS NVARCHAR(MAX)),
CAST(imageval AS VARCHAR(MAX))
WHERE CAST(imageval AS NVARCHAR(MAX)) LIKE N'%TRIGGER%'
OR CAST(imageval AS VARCHAR(MAX)) LIKE '%TRIGGER%'
The above worked for me. YMMV and make sure you sanity check any results (the first method definitely won't work if the definition is split over multiple pages and may find ghosted versions).
If the trigger object is encrypted, I imagine it would be visible in
sys.sysobjvalues using the DAC, though certainly my
LIKE clauses wouldn't find it. You would need to look in
sys.sysschobjs and get the
objid from the name. Hopefully it isn't encrypted or it would need a good read of this article: The Internals of