Database, SQL and log examination

Examining databases and event logs helps check for records, calculation logic and the technical sequence of changes. A test environment does not imply that a production database exists, and a missing record in an export does not prove its absence from the entire system.

Subject of examination

• Database dumps, exports and schemas
• SQL code, procedures and calculation logic
• Logs, backups and environment information

Sample questions for the expert

• What data are actually contained in the materials provided?
• Does the query result match the described logic and selection conditions?
• Which changes and events are supported by the logs?
• Which limitations prevent reconstruction of the system state at the time examined?

The final questions are formulated according to the objects and circumstances of the particular task.

What to prepare

• A list of files provided and a description of their origin
• Schema, DBMS version and the minimum necessary anonymized data
• SQL code, settings and reproduction conditions
• Logs with time zone, period and completeness information

How the examination is conducted

The contents of the received materials are recorded, and test data are distinguished from production data. Checks are reproduced in a controlled environment; queries and selection criteria are documented. Logs are assessed against their retention periods and sources.

Scope and limitations

Do not send passwords or active keys through the form. The conclusion applies to the dataset provided. Missing backups and logs cannot be replaced by assumptions.

What the deliverable records

The opinion lists the data examined, checks reproduced and events confirmed, with limitations concerning completeness and period.