I am assisting a colleague with an analysis for a client, we are carving data out of unallocated clusters from a SQL Server 2005 database (we are seraching for a certain MDF file)
We have the LDF file that coexist with the MDF file in question
Does anyone have information on parsing log files, and information about the data struture of SQL server files as well as information on Header/Footer data?
Any help would be greatly appreciated.
I'm not aware of someone already having reversed this format.
Have you tried looking at multiple MDF files with a hex viewer to determine a common header-like pattern ?
It is unlikely to have a distinct footer
1. because very little file formats have distinct footers
2. because it is probably a paged database file format similar to that of ESE (Jet Blue)
There could be some indication of its size in a database header.
There could be some Jet Red (Access) technology in there.
Have you tried looking on MSDN ?
BTW why is your subject off-topic ?