A method and apparatus for determining when an event occurred in a database is provided. At least a portion of the database is restored to a point in time that is prior to the event. Recovery logs are translated to database operations (e.g., SQL) that are capable of causing the changes described in the recovery logs. A mechanism is created for detecting the event based on execution of the statements. For example, a database trigger is created to detect the event. The database operations are executed against the restored database to cause the mechanism to detect the event.