This chapter is from the book
Artifact Collection
You obtain the version and service pack of the victim instance by examining the DB Configuration | SQL Server Info page within WFT. You collect both volatile and nonvolatile SQL Server artifacts as explained in Chapters 6 and 7 of this book, and then take those artifacts off-site to a forensic laboratory for analysis.