Scenario:

We had a situation where we attempted am upgrade and it didn't go as planned. We had to roll back the snapshot of a VM. For the period of an hour there were entries added (and removed) from the repository. The server that got rolled back was our Laserfiche Server which houses the repository files. 

We could not use Audit Trail since it was on the server in question. Which led me back to where I wanted to begin: the sql server.

I would love to get some feedback on how accurate my query looks. 

Purpose of query:

Show all entries created and modified (with various supporting data as seen in the query) for the time period:

2/1/21 11:30AM PST thru 2/1/21 12:30PM PST.

^Our SQL server is in UTC so add 8 hours to the above times and make then 24hr instead of 12hr.

SELECT toc.created, trustee.trustee_name AS Creator, toc.modified, trustee_1.trustee_name AS Modifier, toc.tocid, toc.name, toc.del_tocid
						 
FROM         toc INNER JOIN
                         trustee ON toc.creator = trustee.sid LEFT JOIN
                         trustee AS trustee_1 ON toc.toc_modifier = trustee_1.sid
			 where toc.modified > '2021-02-01 19:30:00.000' 
			 AND  toc.modified < '2021-02-01 20:30:00.000'

^this is for the modified entries. I swapped out 'where toc.modified' for 'toc.created' to return the created entries.

note: when the column 'del_tocid' is NOT 0 (zero), it indicates an entry has been sent to the recycle bin.

Thank you in advance.