First, a bit about the log(LDF file) in SQL Server. This isn't necessarily a blow-by-blow recording of everything that has been done in the database, but instead is more of a "scratch pad" where work that is in-flight is stored. Periodically, this in-flight work is truncated from the log file when certain events occur (checkpoints).
In regards to your #2 question, this is a matter of understanding how switching between the different recovery models affect the log chain. Going between SIMPLE and FULL modes fundamentally affects how SQL Server handles the transaction log, so whenever you do this you need to take a full backup to "reset" that log chain so SQL Server knows how to properly handle the recovery model. In your example, SQL server was handling the log as if it was in SIMPLE mode immediately after the switch and it wasn't until you took your full backup and reset things that SQL server began to handle things differently.
If anything takes place that could cause your databases to stop and be inconsistent, the log becomes very important in bringing those databases back in a usable state. This recovery happens when the the database is brought back online. SQL Server will first bring up the databases, then apply any in-flight transactions (transactions that haven't been truncated) to those databases. This allows for your database to be consistent with the time that it was taken offline. However, we can't bring those databases back online to a specific point in time this way.
Taking this into account, we need to understand what point in time recovery is for SQL Server. When you recover a database, you are restoring from a database backup. If you want this recovery to be point in time, you need the following:
- The database you wish to recover was in FULL or BULKLOGGED recovery mode.
- You have a full database backup to start with.
- You have an unbroken series of transaction log backups taken after the full backup.
Using these, you can then use your database RESTORE syntax to restore the database to a specific point in time. The basic syntax is:
Restore your full
RESTORE DATABASE foo
FROM DISK='<physical file location of backup>'
WITH NORECOVERY
Restore your logs in order, repeat for each log up to the last one
RESTORE LOG foo
FROM DISK='<physical file location of backup>'
WITH NORECOVERY
Restore your last log, where you want to stop at a specific time
RESTORE LOG foo
FROM DISK='<physical file location of backup>'
STOPAT='<date/time of stopping point>'