介绍:
实验一：
通过操作系统命令，意外删除数据文件(数据库open状态)；
1 创建测试数据
2 意外删除数据文件
3 检查 dbwr 的进程 PID
4 查找被误删除文件句柄
5 拷贝该句柄文件名回原位置
实验二：
通过操作系统命令，意外删除数据文件(数据库无法启动状态)；
1 意外删除数据文件
2 数据库实例被重启，并且无法open
3 extundelete工具尝试找回
实验:
实验一：
1 创建测试数据
SQL> create tablespace test datafile '/u01/app/oracle/oradata/PROD2/test01a.dbf' size 2M autoextend on;
SQL> create user chen identified by a default tablespace test;
SQL> grant connect,resource,dba to chen;
SQL> create table chen.t1 as select level as id from dual connect by level<=10;
2 意外删除数据文件
SQL> host rm -rf /u01/app/oracle/oradata/PROD2/test01a.dbf
SQL> conn chen/a
SQL> create table chen.t3 as select level as id from dual connect by level<=10;
create table chen.t3 as select level as id from dual connect by level<=10
*
ERROR at line 1:
ORA-01116: error in opening database file 6
ORA-01110: data file 6: '/u01/app/oracle/oradata/PROD2/test01a.dbf'
ORA-27041: unable to open file
Linux Error: 2: No such file or directory
Additional information: 3
[oracle@edbjr2p1 ~]$ cd /u01/app/oracle/diag/rdbms/prod2/PROD2/trace/
[oracle@edbjr2p1 trace]$ tail -f alert_PROD2.log
Tue Nov 14 14:50:55 2017
Checker run found 1 new persistent data failures
Tue Nov 14 14:57:08 2017
Errors in file /u01/app/oracle/diag/rdbms/prod2/PROD2/trace/PROD2_m000_4867.trc:
ORA-01116: error in opening database file 6
ORA-01110: data file 6: '/u01/app/oracle/oradata/PROD2/test01a.dbf'
ORA-27041: unable to open file
Linux Error: 2: No such file or directory
Additional information: 3
3 检查dbwr进程 PID
[root@edbjr2p1 ~]# ps -ef|grep dbw0|grep -v grep
oracle 4579 1 0 14:34 ? 00:00:00 ora_dbw0_PROD2
4 查找被误删除文件句柄
dbwr 会打开所有数据文件的句柄。
在 proc 目录中可以查到，目录名是进程 PID，fd 表示文件描述符。
[root@edbjr2p1 4579]# cd /proc/4579/fd/
[root@edbjr2p1 fd]# ls -l
......
lrwx------ 1 oracle oinstall 64 Nov 14 15:00 264 -> /u01/app/oracle/oradata/PROD2/test01a.dbf (deleted)
5 拷贝该句柄文件名回原位置
[root@edbjr2p1 fd]# cp 264 /u01/app/oracle/oradata/PROD2/test01a.dbf
[root@edbjr2p1 fd]# chown oracle.oinstall /u01/app/oracle/oradata/PROD2/test01a.dbf
不用recover数据文件，直接可以使用；
SQL> create table chen.t3 as select level as id from dual connect by level<=10;
Table created.
SQL> alter system checkpoint;
System altered.
SQL> select file#,CHECKPOINT_CHANGE#,status from v$datafile;
FILE# CHECKPOINT_CHANGE# STATUS
---------- ------------------ -------
1 1009869 SYSTEM
2 1009869 ONLINE
3 1009869 ONLINE
4 1009869 ONLINE
5 1009869 ONLINE
6 1009869 ONLINE
6 rows selected.
实验二：
官网下载地址：
https://sourceforge.net/projects/extundelete/files/latest/download?source=top3_dlp_t5
安装extundelete
[root@edbjr2p1 oracle]# ll -rht extundelete-0.2.4.tar.bz2
-rw-r--r-- 1 oracle oinstall 106K Nov 14 15:40 extundelete-0.2.4.tar.bz2
[root@edbjr2p1 oracle]# yum -y install e2fsprogs-libs e2fsprogs e2fsprogs-devel
[root@edbjr2p1 oracle]# rpm -q e2fsprogs-libs e2fsprogs e2fsprogs-devel
[root@edbjr2p1 oracle]# tar jxvf extundelete-0.2.4.tar.bz2
[root@edbjr2p1 extundelete-0.2.4]# pwd
/home/oracle/extundelete-0.2.4
[root@edbjr2p1 extundelete-0.2.4]# ./configure && make && make install
Configuring extundelete 0.2.4
Writing generated files to disk
make -s all-recursive
Making all in src
Making install in src
/usr/bin/install -c extundelete '/usr/local/bin'
[root@edbjr2p1 ~]# extundelete --help
在数据删除之后，首先要卸载被删除数据所在的磁盘或是分区，
如果是系统根分区遭到误删除， 就需要进入单用户模式下，将根分区以只读的方式挂载。
原因：
因为文件删除之后，仅仅是将文件的inode节点中的扇区指针清零，实际上文件还存在磁盘上面.
如果磁盘以读写方式挂载，这些删除的数据块可能会被系统从新分配出去，这些数据块被覆盖之后，这些 数据就真的丢失了，所以以只读的方式挂载，尽可能避免数据被覆盖。
[root@edbjr2p1 ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 15G 5.4G 8.4G 40% /
/dev/sda2 30G 7.6G 21G 27% /u01
/dev/sda1 99M 29M 65M 31% /boot
tmpfs 1.5G 536M 987M 36% /dev/shm
[root@edbjr2p1 ~]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 3932160 164322 3767838 5% /
/dev/sda2 8102656 40214 8062442 1% /u01
/dev/sda1 26104 56 26048 1% /boot
tmpfs 221920 227 221693 1% /dev/shm
[root@edbjr2p1 ~]# umount /u01
umount: /u01: device is busy
umount: /u01: device is busy
[root@edbjr2p1 ~]# fuser -m -v -i -k /u01
[root@edbjr2p1 ~]# umount /u01
使用extundelete恢复单个文件测试
[root@edbjr2p1 /]# cat 000.sh
00000000000000000000000000
11111111111111111111111111
22222222222222222222222222
删除文件
[root@edbjr2p1 /]# rm -rf 000.sh
查看磁盘挂载信息
[root@edbjr2p1 /]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 15G 5.4G 8.4G 40% /
/dev/sda1 99M 29M 65M 31% /boot
tmpfs 1.5G 540M 982M 36% /dev/shm
/dev/sda2 30G 7.6G 21G 27% /u01
恢复
[root@edbjr2p1 /]# extundelete /dev/sda3 --inode 2
......
Loading filesystem metadata ... 120 groups loaded.
Group: 0
Contents of inode 2:
000 98309 Deleted
000.sh 98309 Deleted
000~ 98307 Deleted
恢复指定文件
[root@edbjr2p1 /]# extundelete /dev/sda3 --restore-file 000.sh
......
Loading filesystem metadata ... 120 groups loaded.
Loading journal descriptors ... 30791 descriptors loaded.
Successfully restored file 000.sh
查看文件
[root@edbjr2p1 /]# cd RECOVERED_FILES/
[root@edbjr2p1 RECOVERED_FILES]# cat 000.sh
00000000000000000000000000
11111111111111111111111111
22222222222222222222222222
使用extundelete恢复整个目录
[root@edbjr2p1 /]# mkdir abccc
[root@edbjr2p1 /]# touch /abccc/chen.sh
[root@edbjr2p1 /]# echo 66666666666666666 > /abccc/chen.sh
删除目录
[root@edbjr2p1 /]# rm -rf abccc/
恢复
[root@edbjr2p1 /]# extundelete /dev/sda3 --inode 2
NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
......
abccc 2588673 Deleted
恢复目录文件
[root@edbjr2p1 /]# extundelete /dev/sda3 --restore-directory /abccc
......
Loading filesystem metadata ... 120 groups loaded.
Loading journal descriptors ... 30318 descriptors loaded.
Searching for recoverable inodes in directory /abccc ...
805 recoverable inodes found.
Looking through the directory structure for deleted files ...
805 recoverable inodes still lost.
No files were undeleted.
同理可以恢复被误删除的数据文件等。
###chenjuchao 2023-03-25###
欢迎关注我的公众号《IT小Chen》
扫一扫
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
