LogCarver

LogCarver reads a SQL Server transaction log through fn_dblog and turns deleted and updated rows back into column values. You do not need CDC, auditing or triggers turned on beforehand.

It lists the INSERT, UPDATE and DELETE events for a table with their time, and can print SQL that would reverse or replay each event. It only prints the SQL. It never runs it. Some UPDATE records are stored in a format it can't decode yet, and those are flagged for manual review instead of guessed.

It is a single self-contained Windows executable with no installer. It makes no network calls. You need sysadmin or db_owner rights on the target database.

Limits: it can only see what is still in the log. TRUNCATE and DROP can't be recovered. Some column types (xml, sql_variant, plain time) and compressed tables are refused, not guessed.