What is the LDF file format?
An .ldf file is a Transaction Log File created by Microsoft SQL Server to record every change made to a database before those changes are written to disk. It implements a write-ahead logging strategy: SQL Server writes a log record first, then applies the corresponding change to data pages.
Every .ldf works as the paired companion to a primary .mdf data file. Without a healthy log file the database cannot come online; deleting or losing an .ldf outside of controlled procedures can make a database unrecoverable.
Internally the log is divided into Virtual Log Files (VLFs) - fixed segments that SQL Server allocates and reuses in a circular fashion. Each log record carries a unique Log Sequence Number (LSN), a 10-byte value encoding the file number, block offset, and slot within a 512-byte log block. The LSN chain is what the engine follows during crash recovery to redo committed transactions and undo incomplete ones.
The .ldf underpins several critical SQL Server features:
- Crash recovery - replaying or rolling back in-flight transactions after an unexpected shutdown
- Point-in-time restore - used together with a .bak full backup and .trn log backups under the FULL recovery model
- Replication and Change Data Capture (CDC) - reading committed changes directly from the log
The format is proprietary binary with no publicly documented magic bytes and cannot be opened by hand. Third-party tools such as ApexSQL Log or Redgate SQL Log can decode log records for auditing or forensic purposes. From SQL Server 2017 onward, .ldf files are supported identically on Linux and in Docker containers alongside the .ndf secondary data files.
Security & safety
RISK: MEDIUMThe file is data, not executable, so it carries no direct malware risk. The real danger is operational: deleting or detaching an .ldf from a live or "suspect" database can cause data loss or make the database unrecoverable, and creating a database without its log (or with a rebuilt log) loses in-flight transactions. Never hand-edit an .ldf. If the log is huge, shrink it the supported way (back up the log, then DBCC SHRINKFILE) rather than deleting it. TDE-encrypted logs require the database's certificate/keys to restore.
Format details
in a nutshellPrograms that open LDF files
Windows3 apps
SQL Server Management Studio (SSMS)
Free Attach or restore the database (which references both .mdf and .ldf); use DBCC SQLPERF(LOGSPACE) to inspect log usage. You do not open the .ldf file directly.
Azure Data Studio
Open-source Cross-platform client to connect to the SQL Server instance and manage/restore the database that owns the log.
ApexSQL Log / Redgate SQL Log (forensic log readers)
Paid Specialist read-only auditing tools that decode past transactions from the .ldf/backups for recovery - not general viewers. 
Linux1 app
SQL Server on Linux + sqlcmd / Azure Data Studio
Free Run the SQL Server engine on Linux and restore/attach the database; manage the log through T-SQL. Technical details
deep spec| Encoding | Binary, little-endian |
| Container structure | Sequence of Virtual Log Files (VLFs); SQL Server allocates and reuses VLFs in a circular pattern as log space is freed |
| Log record unit | Variable-length log records packed into 512-byte log blocks |
| Record identifier | Log Sequence Number (LSN) - a 10-byte value encoding the log file number, block offset within the file, and slot number within the block |
| Circular reuse | Log space is reclaimed and reused once the active portion is no longer needed - after a checkpoint in SIMPLE model or a log backup in FULL model |
| Recovery model support | Behavior differs per SQL Server recovery model: SIMPLE (auto-truncates at checkpoint), BULK-LOGGED (minimal logging for bulk operations), FULL (log grows until a log backup is taken) |
| Paired data file | Always paired with at least one `.mdf` primary data file; additional data files use the `.ndf` extension |
| Max file size | Up to 2 TB per log file on Windows NTFS/ReFS; a single database can have multiple `.ldf` files, each subject to this limit |
| Encryption | Unencrypted by default; automatically encrypted when Transparent Data Encryption (TDE) is enabled on the database |
| Compression | The `.ldf` itself is stored uncompressed; log backups written to `.trn` or `.bak` files can use SQL Server backup compression |
| Checksum / integrity | Optional torn-page detection and page checksums configurable at database level; engine validates the LSN chain on every recovery |
| Auto-growth | SQL Server auto-grows the `.ldf` when it fills; growth increment is configurable in fixed MB or percentage; excessive auto-growth in small increments causes VLF fragmentation and slower recovery |
| Internal version binding | Format is tied to the SQL Server engine version and database compatibility level; SQL Server 2022, for example, uses internal database version 904 |
| OS platform support | Windows (all modern SQL Server versions); Linux and Docker containers (SQL Server 2017 and later via SQL Server on Linux) |
| MIME type | application/octet-stream (no dedicated MIME type registered for this format) |
| Direct access | Not intended for direct opening or parsing; accessed through SQL Server engine attachment, RESTORE DATABASE commands, or third-party log readers such as ApexSQL Log or Redgate SQL Log |
| Released | Microsoft SQL Server (log architecture present since the Sybase-derived 4.x/6.x era, 1990s) |
| Latest version | Format tied to the database compatibility/engine version (e.g. SQL Server 2022, internal db version 904) |
| Specification | learn.microsoft.com |
LDF conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about LDF files.
