recover deleted file on ext3

[oracle@goolen ~]$ sqlplus / as sysdba
SQL*Plus: Release 10.2.0.1.0 - Production on Tue Dec 31 20:05:37 2013
Copyright (c) 1982, 2005, Oracle.  All rights reserved.
Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
SQL> select open_mode from v$database;
OPEN_MODE
--------------------
READ WRITE
SQL> select name from v$datafile;
NAME
--------------------------------------------------------------------------------
/opt/oradata/goolen/system01.dbf
/opt/oradata/goolen/undotbs01.dbf
/opt/oradata/goolen/sysaux01.dbf
/opt/oradata/goolen/user01.dbf
+++delete one of datafile

SQL> ! rm -rf /opt/oradata/goolen/user01.dbf

+++once the database is closed,the handle of the file was disappears
SQL> shut abort

ORACLE instance shut down.

+++we can use ext3grep to restore that file
+++scan file's inode and restore  
+++scan deleted file from second inode
[root@goolen ~]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda2              23G  8.0G   14G  39% /
/dev/sda1              99M   12M   83M  12% /boot
tmpfs                 506M     0  506M   0% /dev/shm

/dev/sdb1             9.2G  812M  8.0G  10% /opt/oradata

[root@goolen ~]# ext3grep /dev/sdb1 --ls --inode 2  
Running ext3grep version 0.10.2
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 75
Loading group metadata... done
Minimum / maximum journal block: 1116 / 35028
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 2687232 = Sun Feb  1 10:27:12 1970
Journal transaction 76309 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 21855; min / max sequence numbers: 76087 / 86999
Inode is Allocated
Loading sdb1.ext3grep.stage2... done
The first block of the directory is 1110.
Inode 2 is directory "".
Directory block 1110:
          .-- File type in dir_entry (r=regular file, d=directory, l=symlink)
          |          .-- D: Deleted ; R: Reallocated
Indx Next |  Inode   | Deletion time                        Mode        File name
==========+==========+----------------data-from-inode------+-----------+=========
   0    1 d       2                                         drwxr-xr-x  .
   1    2 d       2                                         drwxr-xr-x  ..
   2    3 d      11                                         drwx------  lost+found

   3  end d  587521                                         drwxr-x---  goolen

[root@goolen ~]# ext3grep /dev/sdb1 --ls --inode 587521  
Running ext3grep version 0.10.2
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 75
Minimum / maximum journal block: 1116 / 35028
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 2687232 = Sun Feb  1 10:27:12 1970
Journal transaction 76309 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 21855; min / max sequence numbers: 76087 / 86999
Inode is Allocated
Loading sdb1.ext3grep.stage2... done
The first block of the directory is 1191936.
Inode 587521 is directory "goolen".
Directory block 1191936:
          .-- File type in dir_entry (r=regular file, d=directory, l=symlink)
          |          .-- D: Deleted ; R: Reallocated
Indx Next |  Inode   | Deletion time                        Mode        File name
==========+==========+----------------data-from-inode------+-----------+=========
   0    1 d  587521                                         drwxr-x---  .
   1    2 d       2                                         drwxr-xr-x  ..
   2    3 r  587522                                         rrw-r-----  control01.ctl
   3    4 r  587523                                         rrw-r-----  control02.ctl
   4    5 r  587524                                         rrw-r-----  control03.ctl
   5    6 r  587525                                         rrw-r-----  redo01.log
   6    7 r  587526                                         rrw-r-----  redo02.log
   7    8 r  587527                                         rrw-r-----  redo03.log
   8    9 r  587528                                         rrw-r-----  system01.dbf
   9   10 r  587529                                         rrw-r-----  undotbs01.dbf
  10   11 r  587530                                         rrw-r-----  sysaux01.dbf
  11  end r  587531                                         rrw-r-----  temp01.dbf

  12  end r  587532  D 1388489259 Tue Dec 31 19:27:39 2013  rrw-r-----  user01.dbf

[root@goolen ~]# 
[root@goolen]# ext3grep /dev/sdb1 --restore-file goolen/user01.dbf             
Running ext3grep version 0.10.2
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 75
Minimum / maximum journal block: 1116 / 35028
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1388358146 = Mon Dec 30 07:02:26 2013
Journal transaction 76309 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 21846; min / max sequence numbers: 75894 / 86813
Writing output to directory RESTORED_FILES/
Finding all blocks that might be directories.
D: block containing directory start, d: block containing more directory entries.
Each plus represents a directory start that references the same inode as a directory start that we found previously.
Searching group 0: DDD
Searching group 1: 
Searching group 2: 
Searching group 3: 
Searching group 4: 
Searching group 5: dd
Searching group 6: 
Searching group 7: ddd
Searching group 8: 
Searching group 9: 
it to lost+found instead!
Writing analysis so far to 'sdb1.ext3grep.stage2'. Delete that file if you want to do this stage again.

Restoring goolen/user01.dbf

+++recovered data is saved in RESTORED_FILES
[root@goolen goolen]# pwd
/root/RESTORED_FILES/goolen
[root@goolen goolen]# ls -l
total 10264

-rw-r----- 1 root root 10493952 Dec 30 23:05 user01.dbf

+++copy this file to corresponding directory
[root@goolen goolen]# cp user01.dbf /opt/oradata/goolen/user01.dbf

[root@goolen goolen]# chown oracle:oinstall /opt/oradata/goolen/user01.dbf

+++recover database：
SQL> recover datafile 4;
Media recovery complete.
SQL> alter database open;

Database altered.