How to track and troubleshoot deleted or updated recordsIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } This article describes how to track deleted or updated records, identify when and how a deletion occurred, and recover data using rollback contexts. Beginning with the London release, ServiceNow captures deletes on instances using the delete recovery tool. If deletes cause records to be updated, those updates are also captured. Scripts run in Scripts - Background are logged along with affected records when the rollback option is enabled. Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Beginning with London Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The following tables and modules can help identify when a deletion occurred and recover data. Check shadow tables (sh$<tableName>) Shadow tables store physical table data on the database. The table structure determines the shadow table name: TPC: The shadow table matches the UI table nameTPH: The shadow table is the base parent table (for example, sh$task for incidents)TPP: The shadow table is either CMDB or a partition (CMDB$ParX) To identify the correct shadow table, enable SQL debug when viewing the table. Key fields: sh$context: The rollback context for this deletionsh$first_recorded: The time the record was deleted Check the Audit Deleted Record table [sys_audit_delete] This table displays all deleted records for audited tables. Key fields: Transaction: The transaction that deleted the recordCreated by [sys_created_by]: The user who deleted the recordCreated on [sys_created_on]: The time the record was deleted Check the Rollback Sequence table [sys_rollback_sequence] This table records all updates and deletes triggered as part of the rollback functionality. To search this table: Use the Document ID column if you have the record sys_idUse the Context column if you found the context from the shadow table Check the Recorded Incremental Change table [sys_rollback_incremental] This table records element-level updates for specific records. Key fields: Element Name: The column that was updatedUpgraded value: The new value of that elementTxn ID: The transaction that made the changeWhen: The time the record was updated Check the Script Execution History table [sys_script_execution_history] This table displays all scripts run in Scripts - Background. Each history record includes an affected records summary. Check the Sys Audit table [sys_audit] for deletions Filter the sys_audit table where New value equals DELETED to identify who deleted a record and when. Contact Service Now Support If you cannot locate a deleted record using these methods, create a ServiceNow Support case. Include your findings from the steps above to help expedite the investigation. Note: Timing is critical for data recovery. Report deletions to Support as soon as possible for the best chance of recovery. Related Links<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Table Structures FAQ How to check what background scripts have been run on your instance Roll back and delete recovery