我个人觉得还是放弃,这些东西microsoft不公开的,只能自己摸索,很困难,做了测试;我觉得log explorer很可能不是用fn_dblog做出来的,因为checkpoint对log explorer毫无作用,而fn_dblog在checkpoint以后,前面的记录全部select不出来,数据库是FULL恢复模式,很早前就有人说过fn_dblog很可能不是log explorer的核心,至于数据解析,看下面:
说明地址:http://raresql.com/2011/10/22/how-to-recover-deleted-data-from-sql-sever/
这段就是分析逻辑
[Fixed Length Data] = Substring (RowLog content 0, Status Bit A+ Status Bit B + 1,2 bytes)
[Total No of Columns]= Substring (RowLog content 0, [Fixed Length Data] + 1,2 bytes)
[Null Bitmap length] = Ceiling ([Total No of Columns]/8.0)
[Null Bytes]= Substring (RowLog content 0, Status Bit A+ Status Bit B + [Fixed Length Data] +1, [Null Bitmap length] )
Total no of variable columns = Substring (RowLog content 0, Status Bit A+ Status Bit B + [Fixed Length Data] +1, [Null Bitmap length] + 2 )
Column Offset Array= Substring (RowLog content 0, Status Bit A+ Status Bit B + [Fixed Length Data] +1, [Null Bitmap length] + 2 , Total no of variable columns*2 )
Variable Column Start = Status Bit A+ Status Bit B + [Fixed Length Data] + [Null Bitmap length] + 2+( Total no of variable columns*2)