extundelete恢复误删除的oracle文件

1、恢复工具ext3grep或者extundelete、e2fsprogs

extundelete工具安装

extundelete下载地址：http://extundelete.sourceforge.net/
wget https://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2
解压该文件tar jxvf extundelete-0.2.4.tar.bz2

[root@QXY1 oracle]# tar jxvf extundelete-0.2.4.tar.bz2 
extundelete-0.2.4/
extundelete-0.2.4/acinclude.m4
extundelete-0.2.4/missing
extundelete-0.2.4/autogen.sh
extundelete-0.2.4/aclocal.m4
extundelete-0.2.4/configure
extundelete-0.2.4/LICENSE
extundelete-0.2.4/README
extundelete-0.2.4/install-sh
extundelete-0.2.4/config.h.in
extundelete-0.2.4/src/
extundelete-0.2.4/src/extundelete.cc
extundelete-0.2.4/src/block.h
extundelete-0.2.4/src/kernel-jbd.h
extundelete-0.2.4/src/insertionops.cc
extundelete-0.2.4/src/block.c
extundelete-0.2.4/src/cli.cc
extundelete-0.2.4/src/extundelete-priv.h
extundelete-0.2.4/src/extundelete.h
extundelete-0.2.4/src/jfs_compat.h
extundelete-0.2.4/src/Makefile.in
extundelete-0.2.4/src/Makefile.am
extundelete-0.2.4/configure.ac
extundelete-0.2.4/depcomp
extundelete-0.2.4/Makefile.in
extundelete-0.2.4/Makefile.am
[root@QXY1 oracle]# 

cd  extundelete-0.2.4
./configure 

[root@QXY1 extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
Writing generated files to disk
[root@QXY1 extundelete-0.2.4]# make 
make -s all-recursive
Making all in src
extundelete.cc:571: warning: unused parameter ‘flags’
[root@QXY1 extundelete-0.2.4]# make install
Making install in src
  /usr/bin/install -c extundelete '/usr/local/bin'
[root@QXY1 extundelete-0.2.4]# 

新建一个测试表空间
create tablespace tt datafile '/u01/app/oradata/QXY1/tt.dbf' size 5M autoextend off

SQL> create tablespace tt datafile '/u01/app/oradata/QXY1/tt.dbf' size 5M autoextend off;

Tablespace created.

SQL>

col file_name for a60
select file_id,file_name,tablespace_name from dba_data_files order by 1; 

   FILE_ID FILE_NAME                                                    TABLESPACE_NAME
---------- ------------------------------------------------------------ ------------------------------------------------------------
         1 /u01/app/oradata/QXY1/system01.dbf                           SYSTEM
         2 /u01/app/oradata/QXY1/sysaux01.dbf                           SYSAUX
         3 /u01/app/oradata/QXY1/tt.dbf                                 TT
         4 /u01/app/oradata/QXY1/users01.dbf                            USERS
         5 /u01/app/oradata/QXY1/example01.dbf                          EXAMPLE
         6 /u01/app/oradata/QXY1/undotbs1.dbf                           UNDOTBS1

6 rows selected.

SQL> 

SQL> select open_mode from v$database;

OPEN_MODE
----------------------------------------
READ WRITE

SQL> !rm -rf /u01/app/oradata/QXY1/tt.dbf    

SQL> !ls -ltr /u01/app/oradata/QXY1/tt.dbf    
ls: cannot access /u01/app/oradata/QXY1/tt.dbf: No such file or directory

SQL> alter system checkpoint;
alter system checkpoint
*
ERROR at line 1:
ORA-03113: end-of-file on communication channel
Process ID: 54517
Session ID: 125 Serial number: 137

SQL> 

通过inode节点恢复
mkdir recovertest
cd recovertest/

[root@QXY1 recovertest]# df -lh | grep /dev/sd
/dev/sda3        56G   41G   12G  78% /
/dev/sda1       194M   34M  151M  19% /boot
[root@QXY1 recovertest]# extundelete /dev/sda3 --inode 2  
NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates 
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n) 
y
Loading filesystem metadata ... 448 groups loaded.
Group: 0
Contents of inode 2:
0000 | 6d 41 00 00 00 10 00 00 a3 67 79 5e 47 59 79 5e | mA.......gy^GYy^
0010 | 47 59 79 5e 00 00 00 00 00 00 1f 00 08 00 00 00 | GYy^............
0020 | 00 00 00 00 37 02 00 00 21 24 00 00 00 00 00 00 | ....7...!$......
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 60 70 62 59 60 70 62 59 30 d1 90 40 | ....`pbY`pbY0..@
0090 | 66 30 de 58 00 00 00 00 00 00 00 00 00 00 02 ea | f0.X............
00a0 | 07 06 44 00 00 00 00 00 1c 00 00 00 00 00 00 00 | ..D.............
00b0 | 73 65 6c 69 6e 75 78 00 00 00 00 00 00 00 00 00 | selinux.........
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 73 79 73 74 65 6d 5f 75 3a 6f 62 6a | ....system_u:obj
00f0 | 65 63 74 5f 72 3a 72 6f 6f 74 5f 74 3a 73 30 00 | ect_r:root_t:s0.

Inode is Allocated
File mode: 16749
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1585014691
Creation time: 1585011015
Modification time: 1585011015
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 31
Blocks count: 8
File flags: 0
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 9249, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0

File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11
boot                                              2359297
dev                                               2883585
proc                                              3145729
sys                                               1835009
var                                               524289
tmp                                               1572865
etc                                               3014657
root                                              2097153
selinux                                           2490369
lib64                                             1966081
usr                                               131073
bin                                               1048577
home                                              655361
lib                                               3276801
media                                             786433
mnt                                               917505
opt                                               3407873
sbin                                              1179649
srv                                               2228225
cgroup                                            1441793
misc                                              2621441
net                                               2752513
.autofsck                                         12
u01                                               3538945
lv                                                2359298
spark                                             2490370
mysql                                             2883586
local_yum                                         3145730
data                                              3145731
[root@QXY1 recovertest]# 

<=======恢复u01目录
extundelete /dev/sda3 --restore-directory u01  

[root@QXY1 recovertest]# cd RECOVERED_FILES/
[root@QXY1 RECOVERED_FILES]# ls
u01
[root@QXY1 RECOVERED_FILES]# ls -ltr
total 4
drwxr-xr-x. 3 root root 4096 Mar 24 18:00 u01
[root@QXY1 RECOVERED_FILES]# cd u01/
[root@QXY1 u01]# ls
app
[root@QXY1 u01]# cd app/
[root@QXY1 app]# ls
diag  fast_recovery_area  oracle  oradata
[root@QXY1 app]# cd oradata/
[root@QXY1 oradata]# ls
QXY1
[root@QXY1 oradata]# cd QXY1/
[root@QXY1 QXY1]# ls
tt.dbf  undotbs3.dbf
[root@QXY1 QXY1]# ls -ltr
total 56336
-rw-r--r--. 1 root root  5251072 Mar 24 18:00 tt.dbf
-rw-r--r--. 1 root root 52436992 Mar 24 18:00 undotbs3.dbf
[root@QXY1 QXY1]# 

[root@QXY1 QXY1]# cp tt.dbf /u01/app/oradata/QXY1/
[root@QXY1 QXY1]# su - oracle
[oracle@QXY1 ~]$ o

SQL*Plus: Release 11.2.0.3.0 Production on Tue Mar 24 18:01:29 2020

Copyright (c) 1982, 2011, Oracle.  All rights reserved.

Connected to an idle instance.

SQL> startup 
ORACLE instance started.

Total System Global Area  584568832 bytes
Fixed Size                  2230552 bytes
Variable Size             180356840 bytes
Database Buffers          394264576 bytes
Redo Buffers                7716864 bytes
Database mounted.
ORA-01114: IO error writing block to file 3 (block # 1)
ORA-01110: data file 3: '/u01/app/oradata/QXY1/tt.dbf'
ORA-27091: unable to queue I/O
ORA-27041: unable to open file
Linux-x86_64 Error: 13: Permission denied
Additional information: 3

<==============================修改权限

SQL> alter database open;

Database altered.

SQL>