Recently, I received a message from one of my clients who had encountered an error in SQL Server. The error message stated “The PageAudit property is incorrect.” This error can be quite confusing and may leave database administrators scratching their heads. In this blog post, we will explore this error in detail and discuss possible solutions.

When my client contacted me, they were experiencing issues with their database startup. The SQL Server error log displayed the following errors:

Msg 5172, Level 16, State 15, Line 1
The header for file 'E:\SQLMDF\FINANCE_DB\FINANCE_DB.mdf' is not a valid database file header. The PageAudit property is incorrect.

Msg 945, Level 14, State 2, Line 1
Database 'FINANCE_DB' cannot be opened due to inaccessible files or insufficient memory or disk space. See the SQL Server errorlog for details.

Msg 5069, Level 16, State 1, Line 1
ALTER DATABASE statement failed.

Msg 5172, Level 16, State 15, Line 1
The header for file 'E:\SQLMDF\FINANCE_DB\FINANCE_DB.mdf' is not a valid database file header. The PageAudit property is incorrect.

Msg 922, Level 14, State 1, Line 1
Database 'FINANCE_DB' is being recovered. Waiting until recovery is finished.

Initially, I was not aware that this error was caused by a ransomware attack on the server. I proceeded to use my usual method of reading the MDF file header without attaching it to the SQL Server instance. I executed the following commands:

DBCC CHECKPRIMARYFILE(N'E:\SQLMDF\FINANCE_DB\FINANCE_DB.mdf',0); --IsMDF
DBCC CHECKPRIMARYFILE(N'E:\SQLMDF\FINANCE_DB\FINANCE_DB.mdf',2)
DBCC CHECKPRIMARYFILE(N'E:\SQLMDF\FINANCE_DB\FINANCE_DB.mdf',3)

From the output of these commands, it was evident that the first command indicated that the file was not valid (output = 0), and the remaining two commands failed with the error message:

Msg 5171, Level 16, State 1, Line 2
E:\SQLMDF\FINANCE_DB\FINANCE_DB.mdf is not a primary database file.

Unfortunately, in this situation, there is not much that a SQL Server Database Administrator (DBA) can do technically. However, I was able to find a helpful link that might assist someone in identifying the ransomware that attacked their system. By visiting a specific website, you can determine the name of the ransomware and check if it is possible to decrypt files using known keys.

Recovering from a ransomware attack can be a challenging and time-consuming process. It is crucial to have proper backup and disaster recovery strategies in place to minimize the impact of such attacks. Regularly backing up your databases and storing the backups in a secure location is essential.

In conclusion, the error “The PageAudit property is incorrect” in SQL Server can be a result of a ransomware attack or other issues with the database file header. It is important to take appropriate measures to protect your SQL Server environment and have a plan in place to recover from such incidents.

Thank you for reading this blog post. I hope you found it informative and helpful. If you have any questions or would like to share your experiences, please leave a comment below.