What caused SQL Server records to disappear?

MS SQL Server 2008 Standard, ShadowProtect Server Edition 4.0.0.5885 -- On Friday, our client discovered that records were 开发者_Python百科missing from the database. I discovered that the Thursday night SQL backup contained all the missing records. User error is ruled out for multiple reasons.

• All missing records fall within an 8-day range
• The date range began 22 days before Friday and ended 14 days before Friday
• All adds and all changes made during the 8-day range are missing from 14 separate tables
• All missing records are present in the Thursday 11pm backup
• The application logs show no unusual incidents as far as I can see.

I find nothing unusual in the Applications list in the MS SQL Server Event Viewer. We are running ShadowProtect Server to make image backups of the 2 server drives every hour. The same sort of incident occurred 4 months ago.

ShadowProtect runs an hourly backup of the database.

One theory is that the ShadowProtect Server 4 disk image software, which runs hourly differential backups, somehow caused the data loss during its 9:00 am Friday backup. I am not aware of any other activity. other than normal user accesses, between the normal 11 pm Thursday database backup and the discovery of missing records on Friday.

Thank you for you help. As you can imagine, the client is very concerned.

If you want to know what is deleting the records or when they got deleted, the database should have audit tables set up that include the usernames and dates of changes. Then you can look at the audit logs to see when reords were deleted and by whom or what process. All databases that contain business critical information should have auditing. Unfortunately, after the event has happened is too late to find out who did it this time through auditing. You might be able to find someone third party product to look through the transaction logs and at least might find out what time the deletes happened if not who. You also should be doing transaction log backups every 15 minutes or so.

I'm not familar with the ShadowProtect server, but the missing data sounds exactly like a script was run (and cacade delete was turned on) and seems unlikely to be the ShadowProtect server. If it was interfering, I would expect a more random kind of change that one that can easily be done by a sql query. Do you allow direct access to your tables? You could have someone trying to harm the data or hide fradulent activities. Threats to the data are not always from outside sources or applications that would be in the event log. Who has access to the delete the data in the database on production? I would suspect a disgruntled employee.

We never did find out the cause of the lost records. We reinstalled the database in another MS SQL Server instance, upgraded the database to a new release, and migrated the data from the old database to the new one. That seems to have fixed the issue.

I had similar issue on VM. The error was was pointing to the database but SQL Server wasn't actually running. For some unknown reason SQL Server has stopped. It seems that VM was restarted and the service didn't start automatically. After starting the service with Windows Administrative Tools, server was back on and the database was there