How to Change Log Record

Suppose you want to have some unknown log record from another LDF file and want to have the DBCC LOG option 3 interpret it.

You can create the empty log file (say, test.ldf), then move the portion of log record from LDF to be read to the test.ldf to appropriate log block sector.

But DBCC LOG will refuse to read the log unless there are small changes in the log record before it can interpret it for you. Suppose the log block will be placed on LSN 00000006:000001C3:0001 in the test.ldf log file.

After the placement (using hex editor) you should change the current LSN of the copied log block to the LSN of destination log file and change the flag at offset 0x07 at destination log file to 0x02. Also don’t forget to change the first byte (green box) to 0x58 :


Using the intercepting technique to change the passed LSN, then we can view the ‘cloned’ log block with ease.

if even by using the trick failed, there are other ways to interpret the log record in this blog, but it is limited to the certain important log operations only (LOP_MODIFY_ROW and LOP_MODIFY_COLUMNS).


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: