Linux中如何恢复被误删的数据文件
Linux环境中文件被删除的恢复，通常有几种情况，如果数据库实例还未停止，那么恢复很easy，如果实例停掉，
那么可能需要借助相关的工具来进行恢复，这里我进行简单的描述。
1. 使用工具进行恢复(ext3grep或者extundelete，e2fsprogs等工具)
我这里使用ext3grep来进行删除文件的恢复，如下是一个例子。
1). 安装rpm包
rpm -ivh ext3grep-0.10.2-1.el4.rf.i386.rpm
2).模拟数据文件被删除的恢复
SQL> !rm -rf /home/ora10g/oradata/roger/roger01.dbf
SQL> shutdown abort;
ORACLE instance shut down.
SQL>
3) 扫描文件inode并restore
|
1
2
3
4
|
[root@killdb ~]# ext3grep /dev/sda3 --ls --inode 2
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted,
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
|
and/orthe file system is in an unclean state.
Number of groups: 201
Loading group metadata... done
Minimum / maximum journal block: 1546 / 9748
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 121640448 = Thu Nov 8 13:00:48 1973
Journal transaction 1459878 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 6294; min / max sequence numbers: 1458017 / 1460214
Inode is Allocated
Finding all blocks that might be directories.
D: block containing directory start, d: block containing more directory entries.
Each plus represents a directory start that references the same inode
asa directory start that we found previously.
Searching group 0: DDddddddddddddddddddddddddddddDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD.......DDDDDDDDDDDDDDDDDDDDdd
Searching group 1: ddDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD.........DDddDDDDDDDDDDDdd
Searching group 2: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDddddD.....DDDDDD
Searching group 3:
Searching group 4: D
。。。。。。。。。
。。。。。。。。。
Adding extended directory block(s)
fordirectory "ora9/product/9.2/sysman/admin".
Writing analysis so far to
'sda3.ext3grep.stage2'. Deletethat file ifyou want to dothis stage again.
The first block of the directory is 1540.
Inode 2 is directory "".
Directory block 1540:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 2 drwxr-xr-x .
1 2 d 2 drwxr-xr-x ..
2 3 d 11 drwx------ lost+found
3 4 d 65409 drwx------ roger
4 5 d 866670 drwxr-xr-x hadoop
5 6 d 1438977 drwxrwxr-x ora10g
6 7 d 3172289 drwx------ ora9
7 8 d 1308161 drwxr-xr-x hbase
8 9 d 2534746 drwxr-xr-x mongodb
9 10 d 1733317 drwxrwxr-x sybase
10 11 d 3106916 drwxr-xr-x puppet
11 12 d 3155939 drwxrwxr-x ggs
12
endd 965021 drwxr-xr-x bak
[root@killdb ~]#
[root@killdb ~]# ext3grep /dev/sda3 --ls --inode 1438977
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted,
and/orthe
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
|
file system is in an unclean state.
Number of groups: 201
Minimum / maximum journal block: 1546 / 9748
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1376229179 = Sun Aug 11 06:52:59 2013
Journal transaction 1459878 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 6293; min / max sequence numbers: 1458318 / 1460214
Inode is Allocated
Loading sda3.ext3grep.stage2................................................................................. done
The first block of the directory is 2906112.
Inode 1438977 is directory "ora10g".
Directory block 2906112:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 1438977 drwxrwxr-x .
1 2 d 2 drwxr-xr-x ..
2 3 r 1439480 rrwxrwxr-x .bash_profile
3 4 r 1438979 rrwxrwxr-x .bash_logout
4 5 r 1438980 rrwxrwxr-x .canna
5 6 r 1438981 rrwxrwxr-x .gtkrc
6 7 r 1438982 rrwxrwxr-x .emacs
7 8 r 1438983 rrwxrwxr-x .bashrc
8 9 r 1438978 rrwxrwxr-x .bash_history
9 10 d 1441395 drwxrwxr-x oraInventory
10 11 d 1441408 drwxrwxr-x product
11 12 r 1439414 rrw-r--r-- log.bbd
12 13 r 1439581 rrw-r--r-- listfile.txt
13 14 d 1471685 drwxrwxr-x archivelog
14 15 d 1783420 drwxrwxr-x admin
15 16 d 1783428 drwxrwxr-x oradata
16 17 r 1439579 rrwxrwxr-x par.bbed
17 18 r 1439418 rrwxrwxr-x exp.log
18 19 r 1439545 rrw-r--r-- par.1
19 20 d 1471689 drwxrwxr-x logs
20 21 d 1504385 drwxrwxr-x core_397796
21 22 r 1439420 rrwxrwxr-x dbv.log
22 23 r 1439415 rrwxrwxr-x odu_308_linux_x86.tar
23 24 d 1455329 drwxrwxr-x odu
24 25 d 1488036 drwxr-xr-x backup
25 26 r 1439422 rrwxrwxr-x stackx
26 27 d 1717028 drwxrwxr-x odu_test
27 28 r 1439410 rrwxrwxr-x core_397796.tar
28 29 d 1717038 drwxrwxr-x pw_cracker
29 30 r 1439421 rrwxrwxr-x stackx1_2.tar
30 31 r 1439424 rrwxrwxr-x README.txt
31 32 r 1439425 rrwxrwxr-x readme.htm
32 33 r 1439426 rrwxrwxr-x core_397796.txt
33 34 r 1439432 rrw-r--r-- sql_hash.sql
34 35 r 1439434 rrwxrwxr-x 7232.out
35 36 r 1439430 rrwxrwxr-x 1
36 37 r 1439431 rrwxrwxr-x kill_spid.sh
37 38 d 1439428 drwxrwxr-x demo
38 39 r 1439527 rrw-r--r-- test.sh.log
39 40 r 1439523 rrw-r--r-- spawrrac.sql
40 41 r 1439433 rrwxrwxr-x 19623.out
41 42 r 1439435 rrwxrwxr-x sndb3_diag_275164.trc
42 43 r 1439436 rrwxrwxr-x ass109.awk
43 44 r 1439437 rrwxrwxr-x sndb3_diag_275164.trc.out
44 45 r 1439439 rrwxrwxr-x a.txt
45 46 r 1439569 rrwxrwxr-x 1.txt
46 47 r 1439440 rrwxrwxr-x free_tab_block.sql
47 48 d 1439485 drwxr-xr-x dul
48 49 r 1439465 rrwxrwxr-x sqlldr.ctl
49 50 r 1439487 rrw-r--r-- a.out
50 51 r 2763489 rrwxrwxr-x locks.lis
51 52 r 2763490 rrwxrwxr-x heap_analyze.txt
52 53 r 2763494 rrwxrwxr-x heap_analyze.sql
53 54 r 2763492 rrwxrwxr-x roger_ora_11076.trc
54 55 r 2763493 rrwxrwxr-x heapdump_analyze
55 56 r 527701 rrwxrwxr-x delete.out
56 57 r 2763495 rrwxrwxr-x heapanalyze.sh
57 58 r 1783457 rrwxrwxr-x delete.sh
58 59 r 527920 rrwxrwxr-x cpu.lst
59 60 r 1783567 rrwxrwxr-x a.sh
60 61 r 527921 rrwxrwxr-x cpu_stats.lst
61 62 r 527922 rrwxrwxr-x sqlhc.sql
62 63 r 527923 rrwxrwxr-x create.sql
63 64 r 527924 rrwxrwxr-x sqlhc.log
64 65 r 527925 rrwxrwxr-x sqlhc_roger_killdb_10.2.0.5.0_96g93hntrzjtr_20120213055519.html
65 66 r 527926 rrwxrwxr-x sqlt.zip
66 67 d 1439443 drwxrwxr-x sqlt
67 68 r 527928 rrwxrwxr-x a.trc
68 69 r 527929 rrwxrwxr-x bug.sql
69 70 r 527927 rrwxrwxr-x crmsiebel_ora_22610144.trc
70 71 r 527930 rrwxrwxr-x b.trc
71 72 r 527932 rrwxrwxr-x awk_10046.awk
72 73 r 527931 rrwxrwxr-x 13982_trc.trc
73 74 r 1439476 rrwxrwxr-x pfile.ora
74 75 d 1504388 drwxrwxr-x doc
75 76 r 1439461 rrwxrwx--- sqlnet.log
76 77 r 1439462 rrwxrwxr-x drop_index_trace.log
77 78 r 1439444 rrwxrwxr-x awrinfo.txt
78 79 d 1504389 drwxrwxr-x logminer
79 80 r 1439464 rrwxrwxr-x 20149.trc
80 81 r 1439460 rrwxrwxr-x sqlldr.log
81 82 r 1439466 rrwxrwxr-x sqlldr.bad
82 83 r 1439472 rrwxrwxr-x sqlldr2.ctl
83 84 r 1978612 rrwxrwxr-x debug.sh
84 85 r 1439467 rrwxrwxr-x sqlldr2.log
85 86 r 1439469 rrwxrwxr-x block_6.dd
86 87 r 1439459 rrwxrwxr-x Undohealth.out
87 88 r 1439471 rrwxrwxr-x undopressure.out
88 89 r 1439474 rrwxrwxr-x undousage.out
89 90 r 1439475 rrwxrwxr-x check_scn.sql
90 91 r 1439477 rrwxrwxr-x chain.sql
91 92 d 1439473 drwxrwxr-x tmp
92 93 d 1504391 drwxr-xr-x nbu
93 94 r 1439478 rrwxrwxr-x chouqu.sql
94 95 r 1439417 rrwxrwxr-x bifile.bbd
95 97 r 1439481 rrwxrwxr-x a.sql
97 98 r 1439499 rrw-r--r-- a.log
98 99 d 1520737 drwx------ .ssh
99 100 r 1439482 rrwxrwxr-x dd.dbf
100 101 r 1439531 rrwxrwxr-x test.sh
101 102 r 1978613 rrwxrwxr-x dtraceio.d
102 103 d 1488033 drwxr-xr-x tools
103 104 d 1439419 drwxr-xr-x scripts
104 105 r 1439503 rrwxr-xr-x listfile.txt.bak
105 106 d 2779847 drwxr-xr-x arch
106 107 r 1439442 rrw-r--r-- control.txt
107 108 d 1488037 drwxr-xr-x flashback
108 109 r 1439534 rrw-r--r-- ass1033.awk
109 110 d 1684260 drwxr-xr-x archivelog1
110 111 r 1439514 rrw-r--r-- odu_415_linux_x86.tar.gz
111 112 r 1439484 rrwxrwxr-x orion_linux_x86
112 113 d 1684273 drwxr-xr-x tmp_area
113 114 r 1439554 rrwxr-xr-x tmp.txt
114 115 r 1439553 rrwxr-xr-x par.tmp
115 116 r 1439542 rrw-r--r-- a.dmp
116 117 r 1784202 rrw-r--r-- awrrpt_1_1258_1259.html
117 118 r 1439536 rrw-r--r-- cncgu21_l028_32519.trc
118 119 r 1439537 rrw-r--r-- dstarget_ora_562140.trc
119 120 r 1439538 rrw-r--r-- zyk_ora_414106.trc
120 121 r 1439540 rrwxrwxr-x strace.sh
121 122 r 1439565 rrw-r--r-- DD-DATAFILE.zip
122 123 r 1439517 rrw-r--r-- test.lun
123 124 r 1439550 rrw-r--r-- DD.zip
124 125 r 1439575 rrw-r--r-- os_header.dd
125 126 r 1439583 rrwxr-xr-x listfile1.txt
126 127 r 1439582 rrwxr-xr-x par.bbed1
127 128 r 1439546 rrw-r--r-- t_logical_corruption.dmp
128 129 r 1439498 rrwxrwxr-x backup_db.log
129 130 r 1439548 rrw-r--r-- c.log
130 131 r 1439551 rrw-r--r-- d.log
131 132 r 1439552 rrw-r--r-- 1.log
132 133 r 1439555 rrw-r--r-- 0417.dd
133 134 r 1439511 rrw-r--r-- aaaa.log
134 135 r 1439512 rrw-r--r-- 11.log
135 136 r 1439378 rrw-r--r-- a14402.trc
136 137 r 1439558 rrw-r--r-- a2.log
137 138 r 1439559 rrw-r--r-- a1.trc
138 139 r 1439429 rrw-r--r-- test_20130604_2228_summary.txt
139 140 r 1439519 rrw-r--r-- test_20130604_2228_mbps.csv
140 141 r 1439520 rrw-r--r-- test_20130604_2228_iops.csv
141 142 r 1439522 rrw-r--r-- test_20130604_2228_lat.csv
142 143 r 1439528 rrw-r--r-- test_20130604_2228_trace.txt
143 144 r 1439377 rrw-r--r-- test_20130604_2249_summary.txt
144 145 r 1439529 rrw-r--r-- test_20130604_2249_mbps.csv
145 146 r 1439532 rrw-r--r-- test_20130604_2249_iops.csv
146 147 r 1439543 rrw-r--r-- test_20130604_2249_lat.csv
147 148 r 1439560 rrw-r--r-- test_20130604_2249_trace.txt
148 149 r 1439562 rrw-r--r-- coe_xfr_sql_profile.log
149 150 r 1439563 rrw-r--r-- coe_xfr_sql_profile.sql
150 151 r 1439566 rrw-r--r-- coe_xfr_sql_profile_50gr3nwzq39nf_684537719.sql
151 153 r 1439564 rrw-r--r-- coe_xfr_sql_profile_50gr3nwzq39nf_684537719.log
153 154 r 1439571 rrw-r--r-- a1.txt
154 155 r 1439567 rrw-r--r-- sql_plan_exchange.sql
155 156 r 1439606 rrwxr-xr-x par.bbed2
156 157 r 1439544 rrw-r--r-- getpid.sql
157 158 r 1439605 rrw-r--r-- a2.txt
158 159 r 1439556 rrw-r--r-- a1.log
159 160 r 1439506 rrw-r--r-- awrrpt_1_33571_33572.html
160 161 r 1439576 rrw-r--r-- getstat_undo.sql
161 162 r 1439573 rrwxrwxr-x listfile.old
162 163 r 1439572 rrw-r--r-- orasrp-linux.zip
163 164 r 1439561 rrw-r--r-- test_undo1_insert.sql
164 165 r 1439570 rrw-r--r-- test_undo1_insert2.sql
165 166 r 1439530 rrw-r--r-- exp_t.dmp
166
endr 1439574 rrw-r--r-- 12560.log
[root@killdb ~]#
[root@killdb ~]# ext3grep /dev/sda3 --ls --inode 1783428
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted,
and/orthe file system is in an unclean state.
Number of groups: 201
Minimum / maximum journal block: 1546 / 9748
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1376229179 = Sun Aug 11 06:52:59 2013
Journal transaction 1459878 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 6293; min / max sequence numbers: 1458318 / 1460214
Inode is Allocated
Loading sda3.ext3grep.stage2................................................................................................................ done
The first block of the directory is 3598344.
Inode 1783428 is directory "ora10g/oradata".
Directory block 3598344:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 1783428 drwxrwxr-x .
1 2 d 1438977 drwxrwxr-x ..
2 3 d 1783429 drwxrwxr-x roger
3 4 d 2698081 drwxr-xr-x recover
4 6 d 1896850 drwxr-xr-x aux
5 6 r 1160995 D 1374650893 Wed Jul 24 00:28:13 2013 rrw-r----- system01.dbf
6
endr 1160993 rrw-r--r-- awrrpt_1_944_945.html
7 8 r 1063076 D 1373425824 Tue Jul 9 20:10:24 2013 rrw-r----- a_data_D-ROGER_I-2466925865_TS-ROGER_FNO-2_0cod7kbr.bak
8 10 r 1063077 D 1373425828 Tue Jul 9 20:10:28 2013 rrw-r----- a_data_D-ROGER_I-2466925865_TS-SYSTEM_FNO-1_0dod7kgc.bak
9 10 r 1063078 D 1373425827 Tue Jul 9 20:10:27 2013 rrw-r----- a_data_D-ROGER_I-2466925865_TS-SYSAUX_FNO-3_0eod7khp.bak
10
endr 1063079 D 1373425830 Tue Jul 9 20:10:30 2013 rrw-r----- a_data_D-ROGER_I-2466925865_TS-USERS_FNO-4_0fod7kj7.bak
11
endr 1063080 D 1373425829 Tue Jul 9 20:10:29 2013 rrw-r----- a_data_D-ROGER_I-2466925865_TS-UNDOTBS2_FNO-6_0god7kk0.bak
12
endr 1063081 D 1373425824 Tue Jul 9 20:10:24 2013 rrw-r----- a_data_D-ROGER_I-2466925865_TS-SQLT_FNO-8_0hod7kkf.bak
13
endr 1063082 D 1373425819 Tue Jul 9 20:10:19 2013 rrw-r----- a_cf_D-ROGER_id-2466925865_0iod7kkm.bak
14
endr 1063083 D 1373425819 Tue Jul 9 20:10:19 2013 rrw-r----- a_0jod7kkp_1_1.bak
[root@killdb /]# ext3grep /dev/sda3 --ls --inode 1783429
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted,
and/orthe file system is in an unclean state.
Number of groups: 201
Minimum / maximum journal block: 1546 / 9748
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1376231625 = Sun Aug 11 07:33:45 2013
Journal transaction 1459878 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 6901; min / max sequence numbers: 1458725 / 1460308
Inode is Allocated
Loading sda3.ext3grep.stage2................................................................................................................ done
The first block of the directory is 3598345.
Inode 1783429 is directory "ora10g/oradata/roger".
Directory block 3598345:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 1783429 drwxrwxr-x .
1 2 d 1783428 drwxrwxr-x ..
2 3 r 1783455 rrw-r----- control01.ctl
3 4 r 1783456 rrw-r----- control02.ctl
4 5 r 1783458 rrw-r----- control03.ctl
5 6 r 1783465 rrw-r----- system01.dbf
6 8 r 1783466 rrw-r----- sysaux01.dbf
7 8 r 1784045 D 1376286019 Sun Aug 11 22:40:19 2013 rrw-r----- roger01.dbf
8 9 r 1783470 rrw-r----- undotbs01.dbf
9 10 r 1783500 rrw-r----- users01.dbf
10 11 r 1783898 rrw-r----- redo01.log
11 12 r 1783899 rrw-r----- redo02.log
12 13 r 1783900 rrw-r----- redo03.log
13 14 r 1783903 rrw-r----- temp01.dbf
14
endr 1783992 rrw-r----- system02.dbf
15 16 r 1785770 D 1374650901 Wed Jul 24 00:28:21 2013 rrw-r----- redo02.log
16
endr 1079300 D 1374650901 Wed Jul 24 00:28:21 2013 rrw-r----- redo04.log
17
endr 1079301 D 1374650901 Wed Jul 24 00:28:21 2013 rrw-r--r-- dd.undo
18
endr 1079233 D 1374650919 Wed Jul 24 00:28:39 2013 rrw-r----- temp02.dbf
|
开始恢复被删掉的文件：
ext3grep /dev/sda3 �Crestore-file ora10g/oradata/roger/roger01.dbf
注意这里的格式，后面的路径不能加/home。跟前面的Inode 1783429 is directory “ora10g/oradata/roger”. 保持一致。
或者
ext3grep /dev/sda3 �Crestore-inode 1784045
或者恢复整个目录
ext3grep /home/store/file �Crestore-all
如下是我的操作过程：
|
1
2
3
4
5
6
7
8
9
10
11
12
13
|
[root@killdb /]# ext3grep /dev/sda3 --restore-file ora10g/oradata/roger/roger01.dbf
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted,
and/orthe file system is in an unclean state.
Number of groups: 201
Minimum / maximum journal block: 1546 / 9748
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1376231625 = Sun Aug 11 07:33:45 2013
Journal transaction 1459878 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 6903; min / max sequence numbers: 1458725 / 1460310
Loading sda3.ext3grep.stage2................................................................................................................ done
Restoring ora10g/oradata/roger/roger01.dbf
[root@killdb /]#
|
恢复出来的文件，会存放在如下地方：
|
1
2
3
4
5
6
|
[root@killdb roger]# pwd
/RESTORED_FILES/ora10g/oradata/roger
[root@killdb roger]# ls -ltr
total 205016
-rw-r----- 1 root root 209723392 Aug 11 22:26 roger01.dbf
[root@killdb roger]#
|
4). 恢复完成之后并move，将文件属主改掉，最后进行recover
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
[root@killdb roger]# mv roger01.dbf /home/ora10g/oradata/roger/
[root@killdb roger]# cd /home/ora10g/oradata/roger
[root@killdb roger]#
chownora10g:oinstall roger01.dbf
[root@killdb roger]# ls -ltr
total 1165464
-rw-r----- 1 ora10g oinstall 20979712 Aug 11 05:45 temp01.dbf
-rw-r----- 1 ora10g oinstall 5251072 Aug 11 22:26 users01.dbf
-rw-r----- 1 ora10g oinstall 26222592 Aug 11 22:26 undotbs01.dbf
-rw-r----- 1 ora10g oinstall 5251072 Aug 11 22:26 system02.dbf
-rw-r----- 1 ora10g oinstall 471867392 Aug 11 22:26 system01.dbf
-rw-r----- 1 ora10g oinstall 293609472 Aug 11 22:26 sysaux01.dbf
-rw-r----- 1 ora10g oinstall 209723392 Aug 11 22:26 roger01.dbf
-rw-r----- 1 ora10g oinstall 52429312 Aug 11 22:27 redo03.log
-rw-r----- 1 ora10g oinstall 52429312 Aug 11 22:27 redo02.log
-rw-r----- 1 ora10g oinstall 52429312 Aug 11 22:27 redo01.log
-rw-r----- 1 ora10g oinstall 7389184 Aug 11 22:28 control03.ctl
-rw-r----- 1 ora10g oinstall 7389184 Aug 11 22:28 control02.ctl
-rw-r----- 1 ora10g oinstall 7389184 Aug 11 22:28 control01.ctl
[root@killdb roger]#
开始进行recover：
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
|
<pre class="brush:sql">[root@killdb roger]# su - ora10g
[ora10g@killdb ~]$ sqlplus "/as sysdba"
SQL*Plus: Release 10.2.0.5.0 - Production on Sun Aug 11 23:05:01 2013
Copyright (c) 1982, 2010, Oracle. All Rights Reserved.
Connected to an idle instance.
SQL> startup mount
ORACLE instance started.
Total System Global Area 167772160 bytes
Fixed Size 1272600 bytes
Variable Size 75498728 bytes
Database Buffers 88080384 bytes
Redo Buffers 2920448 bytes
Database mounted.
SQL> recover datafile 5;
Media recovery complete.
SQL> alter database open;
Database altered.
SQL></pre>
|
|
1
2
|
2. 数据库open的情况下，文件被删除
当数据库未关闭时,数据文件被删除恢复起来还是很容易的,不管是linux还是unix都非常简单,如下是一个例子:
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
|
SQL> select open_mode from v$database;
OPEN_MODE
----------
READ WRITE
SQL> set lines 200
SQL> col name
fora65
SQL> select file#,name from v
$datafile;
FILE# NAME
---------- -----------------------------------------------------------------
1 /home/ora10g/oradata/roger/system01.dbf
2 /home/ora10g/oradata/roger/undotbs01.dbf
3 /home/ora10g/oradata/roger/sysaux01.dbf
4 /home/ora10g/oradata/roger/users01.dbf
5 /home/ora10g/oradata/roger/roger01.dbf
6 /home/ora10g/oradata/roger/system02.dbf
6 rows selected.
SQL> !rm -rf /home/ora10g/oradata/roger/users01.dbf
SQL>
SQL> !
[ora10g@killdb ~]$ ls -ltr /home/ora10g/oradata/roger
total 1165464
-rw-r----- 1 ora10g oinstall 20979712 Aug 11 05:45 temp01.dbf
-rw-r----- 1 ora10g oinstall 5251072 Aug 11 23:06 system02.dbf
-rw-r----- 1 ora10g oinstall 209723392 Aug 11 23:06 roger01.dbf
-rw-r----- 1 ora10g oinstall 52429312 Aug 11 23:06 redo03.log
-rw-r----- 1 ora10g oinstall 52429312 Aug 11 23:06 redo02.log
-rw-r----- 1 ora10g oinstall 293609472 Aug 11 23:11 sysaux01.dbf
-rw-r----- 1 ora10g oinstall 26222592 Aug 11 23:11 undotbs01.dbf
-rw-r----- 1 ora10g oinstall 471867392 Aug 11 23:11 system01.dbf
-rw-r----- 1 ora10g oinstall 52429312 Aug 11 23:11 redo01.log
-rw-r----- 1 ora10g oinstall 5251072 Aug 11 23:11 users01.dbf
-rw-r----- 1 ora10g oinstall 7389184 Aug 11 23:11 control03.ctl
-rw-r----- 1 ora10g oinstall 7389184 Aug 11 23:11 control02.ctl
-rw-r----- 1 ora10g oinstall 7389184 Aug 11 23:11 control01.ctl
[ora10g@killdb ~]$ exit
exit
+++
copydatafile
[ora10g@killdb roger]$ ps -ef|grep dbw
ora10g 7193 1 0 23:05 ? 00:00:00 ora_dbw0_roger
ora10g 7367 5727 0 23:09 pts/3 00:00:00 grep dbw
[ora10g@killdb roger]$ cd /proc/7193
[ora10g@killdb 7193]$ cd fd
[ora10g@killdb fd]$ ls -ltr
total 26
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 0 -> /dev/null
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 7 -> /home/ora10g/product/10.2/dbs/lkinstroger (deleted)
l-wx------ 1 ora10g oinstall 64 Aug 11 23:10 6 -> /home/ora10g/admin/roger/bdump/alert_roger.log
l-wx------ 1 ora10g oinstall 64 Aug 11 23:10 5 -> /home/ora10g/admin/roger/udump/roger_ora_7172.trc
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 4 -> /dev/null
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 3 -> /dev/null
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 2 -> /dev/null
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 1 -> /dev/null
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 9 -> /home/ora10g/product/10.2/dbs/hc_roger.dat
l-wx------ 1 ora10g oinstall 64 Aug 11 23:10 8 -> /home/ora10g/admin/roger/bdump/alert_roger.log
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 25 -> /home/ora10g/product/10.2/rdbms/mesg/oraus.msb
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 24 -> /home/ora10g/oradata/roger/temp01.dbf
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 23 -> /home/ora10g/oradata/roger/system02.dbf
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 22 -> /home/ora10g/oradata/roger/roger01.dbf
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 21 -> /home/ora10g/oradata/roger/users01.dbf
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 20 -> /home/ora10g/oradata/roger/sysaux01.dbf
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 19 -> /home/ora10g/oradata/roger/undotbs01.dbf
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 18 -> /home/ora10g/oradata/roger/system01.dbf
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 17 -> /home/ora10g/oradata/roger/control03.ctl
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 16 -> /home/ora10g/oradata/roger/control02.ctl
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 15 -> /home/ora10g/oradata/roger/control01.ctl
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 14 -> /home/ora10g/product/10.2/dbs/lkROGER
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 13 -> /home/ora10g/product/10.2/dbs/hc_roger.dat
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 12 -> /home/ora10g/product/10.2/rdbms/mesg/oraus.msb
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 11 -> /dev/zero
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 10 -> /dev/zero
[ora10g@killdb fd]$ pwd
/proc/7193/fd
[ora10g@killdb fd]$ cp /proc/7193/fd/21 /home/ora10g/oradata/roger/users01.dbf
[ora10g@killdb fd]$
+++++将datafile copy之后,进行recover
SQL> recover datafile 4;
ORA-00283: recovery session canceled due to errors
ORA-01124: cannot recover data file 4 - file is in
useorrecovery
ORA-01110: data file 4: '/home/ora10g/oradata/roger/users01.dbf'
SQL> shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> startup mount
ORACLE instance started.
Total System Global Area 167772160 bytes
Fixed Size 1272600 bytes
Variable Size 75498728 bytes
Database Buffers 88080384 bytes
Redo Buffers 2920448 bytes
Database mounted.
SQL> recover datafile 4;
Media recovery complete.
SQL> alter database open;
Database altered.
SQL> select file#,name,status from v$datafile;
FILE# NAME STATUS
---------- ----------------------------------------------------------------- -------
1 /home/ora10g/oradata/roger/system01.dbf SYSTEM
2 /home/ora10g/oradata/roger/undotbs01.dbf ONLINE
3 /home/ora10g/oradata/roger/sysaux01.dbf ONLINE
4 /home/ora10g/oradata/roger/users01.dbf ONLINE
5 /home/ora10g/oradata/roger/roger01.dbf ONLINE
6 /home/ora10g/oradata/roger/system02.dbf SYSTEM
6 rows selected.
SQL>
|
或者使用lsof命令进行查看，然后进行copy：
|
1
2
3
4
5
6
7
8
9
10
11
12
|
[ora10g@killdb fd]$ ps -ef|grep dbw|grep -v grep
ora10g 7491 1 0 23:12 ? 00:00:00 ora_dbw0_roger
[ora10g@killdb fd]$ lsof -a -p 7491 | egrep "COMMAND|dbf"
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
oracle 7491 ora10g 18uW REG 8,3 471867392 1783465 /home/ora10g/oradata/roger/system01.dbf
oracle 7491 ora10g 19uW REG 8,3 26222592 1783470 /home/ora10g/oradata/roger/undotbs01.dbf
oracle 7491 ora10g 20uW REG 8,3 293609472 1783466 /home/ora10g/oradata/roger/sysaux01.dbf
oracle 7491 ora10g 21uW REG 8,3 5251072 1784064 /home/ora10g/oradata/roger/users01.dbf
oracle 7491 ora10g 22uW REG 8,3 209723392 1784045 /home/ora10g/oradata/roger/roger01.dbf
oracle 7491 ora10g 23uW REG 8,3 5251072 1783992 /home/ora10g/oradata/roger/system02.dbf
oracle 7491 ora10g 24uW REG 8,3 20979712 1783903 /home/ora10g/oradata/roger/temp01.dbf
[ora10g@killdb fd]$
|
直接copy 相关文件即可，该操作更为简单：
|
1
|
copy/proc/7491/fd/21 /home/ora10g/oradata/roger/user01.dbf
|
总的来说，对于文件从操作系统级别删掉的情况，如果inode在未被覆盖之前，都是可以恢复，一旦覆盖就难以恢复了，
所以我们建议，一旦有文件被删掉，那么建议将该文件系统umount掉，以免信息被覆盖。