Point in Time Scenario:--9 Records - Full Backup - 06:30PM

backup database KDSSGDB to disk=N'C:\Media\KDSSGDB_Full.bak'

--Insert at 06:31PM
use KDSSGDB
go
insert into Tab select * from TAb
--18Records - Diff Backup - 06:32PM
backup database KDSSGDB to disk=N'C:\Media\KDSSGDB_Diff.bak' WITH DIFFERENTIAL
--Insert at 06:33PM
use KDSSGDB
go
insert into Tab select * from TAb
--36Records - Tlog Backup1 - 06:34PM
backup log KDSSGDB to disk=N'C:\Media\KDSSGDB_Tlog1.trn'
--Insert at 06:35PM
use KDSSGDB
go
insert into Tab select * from TAb
--72Records - Tlog Backup2 - 06:36PM
backup log KDSSGDB to disk=N'C:\Media\KDSSGDB_Tlog2.trn'
--Drop the Table at 06:37PM
drop table Tab
create table Tab2(sno int, sname varchar(50))
--No Table - Tlog Backup 3 - 06:38PM
backup log KDSSGDB to disk=N'C:\Media\KDSSGDB_Tlog3.trn'
Command for Point-In-Time Restore:RESTORE DATABASE KDSSGDB_COPY from disk=N'C:\Media\KDSSGDB_Full.bak'
WITH
MOVE 'KDSSGDB' TO 'C:\Media\KDSSGDB_Copy.mdf',
MOVE 'KDSSGDB_Log' TO 'C:\Media\KDSSGDB_Copy_log.ldf',
NORECOVERY
RESTORE DATABASE KDSSGDB_COPY from disk=N'C:\Media\KDSSGDB_Diff.bak' WITH NORECO
VERY
RESTORE LOG KDSSGDB_COPY from disk=N'C:\Media\KDSSGDB_Log1.trn' WITH RECOVERY, S
TOPAT=N'2015-09-01T06:34:00'
If Application Owner is not happy with the returned table and number of records
in it. They may provide one more estimated timeline. It is better to check from
DBA end the exact LSN number of Table Drop.
select [Current LSN], [Operation], [Transaction ID], [Parent Transaction ID],
[Begin Time], [Transaction Name], [Transaction SID]
from fn_dblog(null, null)
where [Operation] = 'LOP_BEGIN_XACT'

If log file was truncated, then we can use fn_dump_dblog to retrieve LSN informa
tion from Log Backup.
SELECT Operation,[Current LSN],[Transaction Name]
FROM fn_dump_dblog
(
DEFAULT, DEFAULT, DEFAULT, DEFAULT,
'C:\Media\KDSSGDB_Tlog3.trn',
DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT
)
where OPERATION='LOP_BEGIN_XACT'
GO
RESTORE LOG AdventureWorks FROM DISK = 'C:\OurBackups\adventureworks_log.bak'
WITH STOPATMARK = 'lsn:15000000040000037'
GO
Prefix 0x in the LSN number which is identified and prefix it with 'lsn:0x' for
hexadecimal format.
RESTORE LOG [PITDB_Temp] FROM DISK = N'C:\OurBackups\PIT_Tlog3.trn' WITH
STOPBEFOREMARK = N'lsn:0x00000025:000000d7:0001', NORECOVERY