1. Reverse Engineering The Database
Brandon Tucker – DBA, OppenheimerFunds, Inc.

2. Who Am I? Brandon Tucker BS Computer Science, Neumont University
MCITP: DB Developer
VP Events, Denver SQL Server User Group
DBA, DB Dev, Consultant
Financial, health insurance, transportation, education industries
SQL 2005 – 2012
Presented at events in multiple states
Has a wicked case of wanderlust… :)

3. Find The Man/Woman Of Your Dreams!
After This Session…
You’ll be able to:
Use a few tools to dabble in reverse engineering a database
Run Faster!
Hack Any Database!
Find The Man/Woman Of Your Dreams!
Make $1,000,000!

4. Third-Party Applications
Agenda
Third-Party Applications
Why Reverse Engineer?
Tools Available
Methods
Recap, Q / A

5. Third-Party Applications Introduction
“We have this new product, can you create the database for us?” (DBA)
“We have this new product and it needs a database server!” (Dev)

6. Third-Party Applications Types
Phone systems
Ticketing systems
Monitoring software
SQL Sentry, Idera, Quest, Confio, etc
SQL Server Management Studio
OK, maybe not, but makes a good demo!
master & msdb are storing data behind the scenes!

7. Third-Party Applications
Agenda
Third-Party Applications
Why Reverse Engineer?
Tools Available
Methods
Recap, Q / A

8. Why Reverse Engineer? Reasons
Someone thought the information was important enough to store somewhere other than text files
Someone thought there was a lot of information
Limited tools provided by the vendor
Limited views of the data

9. Why Reverse Engineer? Reasons
And…
You’re probably smarter than the vendor anyway…
You know more about the value of the information…
You care more…
You could make your life easier/better/<insert adjective here>!

10. Third-Party Applications
Agenda
Third-Party Applications
Why Reverse Engineer?
Tools Available
Methods
Recap, Q / A

11. Tools Available Introduction
Need to capture queries coming through the system
Need to look at how data changes
Need to be able to piece things together

12. Object Explorer SQL Server Profiler Data Compares Database Audits
Tools Available List
Object Explorer
SQL Server Profiler
Data Compares
Database Audits
Change Data Capture
Plenty of others

13. Tools Available Object Explorer
Found in Management Studio
Easiest way to browse objects in a database
Gives a good 50,000 foot view
Are the tables intelligibly named?
Difficult with a large number of tables

14. Tools Available SQL Profiler
Traces
Stored Procedures-RPC:Starting
Stored Procedures-SP:StmtStarting
TSQL-SQL:StmtStarting
Provides the most information with little prior knowledge
May take a few tries to narrow down your search
DEMO: SQL Server Profiler

15. Tools Available Others
Data compares, Database Audits, Change Data Capture
These all look at the data itself
Good if you have a small number of tables and low throughput
Likely not the case

16. Third-Party Applications
Agenda
Third-Party Applications
Why Reverse Engineer?
Tools Available
Methods
Recap, Q / A

17. We need to find where the data goes (tables)
Methods Plan of Attack
We need to find where the data goes (tables)
We need to find how the data gets there
DML statements?
Stored procs?
Once we know these, we can start putting the pieces together

18. Methods Where Does The Data Go?
If possible, use your application to put in some data
Use SQL Server Profiler on all SQL hitting that server/database (if known)
Pick text that you might be able to filter on
Create a customer record with a “zzzz” name
Create a new ticket with “zzzz” in the description
Be careful about developing in production!

19. Methods How Did The Data Get There?
Try to identify the SQL that put the data in
Was it an INSERT statement?
Was it a stored procedure?
DEMO: SQL Agent job
These are relational databases; the data is likely in multiple places!
Don’t be content with just one table

20. Methods Putting The Pieces Together
This will feel very much like a puzzle
Use all of the tools available to you!
Object Explorer can help with foreign keys (think Database Diagrams)
Data deltas/audits can show you the complete data picture
More specific traces (host, user) can reduce the noise and get you to the good stuff

21. Methods Putting The Pieces Together
Try writing queries to see if things make sense
“Shaping” queries
DEMO: msdb query
Be creative in figuring out short names, acronyms, etc.
Make the data work for your needs
Remember: a lot of databases are poorly designed/built!

22. Third-Party Applications
Agenda
Third-Party Applications
Why Reverse Engineer?
Tools Available
Methods
Recap, Q / A

23. Musings, Gotchas, Closing Thoughts
This is not a perfect science
Companies trying to obfuscate their database can make things very difficult
Encrypted stored procedures can spell D-O-O-M for you
As with all monitoring, be careful of your impact to the environment

24. Outro
Q / A
Thank You!

25. Community/SWAG Sponsors
Thank You Sponsors!
Gold Sponsor
Silver Sponsors
Marquee Sponsors
Bronze Sponsors
Qortex
Community/SWAG Sponsors