Is there a way to find out who dropped a database in SQL Server 2005 and the time / date that it was dropped?


If it was recent enough, it may still be in the default trace. The basic assumption will be that the DROP event will be the last event recorded for this database. So if someone dropped the database 'splunge' you should be able to catch it this way (again depending on how long ago it happened):

DECLARE @FileName VARCHAR(255)  

SELECT @FileName = SUBSTRING(path, 0, 
    LEN(path)-CHARINDEX('\', REVERSE(path))+1) + '\Log.trc'  --'
  FROM sys.traces WHERE is_default = 1;  

SELECT TOP 1 LoginName, HostName, ApplicationName, StartTime, TextData
  FROM sys.fn_trace_gettable( @FileName, DEFAULT ) AS gt  
  WHERE EventClass = 47 AND DatabaseName = 'splunge'
  ORDER BY StartTime DESC;
|improve this answer|||||

If you use SQL Server Managnment Studio, You can simply see all the data in the Report -> Standard Reports -> Schema Changes History

Details at: SQL Server: How to Find which user deleted the database in SQL Server

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.