Hello All..

We use a program which stores it's data in an SQl 2008 DB.  On Monday 8/17 the staff entered a large amount of data (not an odd occurrence for this dept).  On Tuesday 8/18 the data entered on 8.17 was gone (older data was there).

The vendor's explanation is "our logs show that our application did not alter the database and only someone using the management console could have altered the database in this manner".  Now, I can tell you I am the only person who would go near this server.  Since I don't know SQL very well, I wouldn't dare use the mgmt console unless I had the vendor connected and was troubleshooting an issue for us.  

I'd like to get to the bottom of this and prove the vendor wrong.  Are there transaction logs via the mgmt studio that would show me something/anything that would help figure out what happened?  ANY SUGGESTIONS would be greatly appreciated.

Thank you.

Well its difficult to tell who altered database, do you have audit configured ? Anything special in errorlog.

Let me tell you upfront SQl Server itself cannot delete or alter records it is sure someone fired some commands and latered it. Since you have come asking questions then this points that application user who has rights to eprform this action did it.

So what actually happened, is it like the data that was entered is lost ?

A possible reason could be that someone restore a database backup of the previous day. You can check it in SSMS by doing a right mouse click on the database => "Reports" => "Standard Reports" => "Backup and Restore Events".