The web server logs show POST requests which do not show raw data sent. Just date/time, source IP address, URI, user agent, etc.

Need the PCAP to see actual raw POST data.

Even SQL logs will not likely show data was changed. Just the actual data in the database. The changes come from the raw POST data.

Compare those PCAPS with the web server logs to see what data was being changed.

They probably used IIS on Windows. Not Apache.