QuickBooks Transaction Logs

QuickBooks '.TLG' files are database transaction logs: list of modifications executed by the database engine. QuickBooks Forensics sorts log transactions based on tables affected, thus tables history can be tracked step by step. Transaction logs can be a perfect tool to learn QuickBooks internals as well. Company file .tlg file can be moved (renamed) after every "open -> simple modification -> close" test to collect set of logs to analyze. The image below shows tables modified by QB user login and logout.


For example, abmc_current_user table is temporary filled with the current user login details: QB version, IP, etc. This table transaction history can be used to track local and network logins.