recover deleted file on ext3

来源：互联网发布：数据分析与商务智能编辑：程序博客网时间：2024/05/16 18:04

[oracle@goolen ~]$ sqlplus / as sysdba
SQL*Plus: Release 10.2.0.1.0 - Production on Tue Dec 31 20:05:37 2013
Copyright (c) 1982, 2005, Oracle. All rights reserved.
Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
SQL> select open_mode from v$database;
OPEN_MODE
--------------------
READ WRITE
SQL> select name from v$datafile;
NAME
--------------------------------------------------------------------------------
/opt/oradata/goolen/system01.dbf
/opt/oradata/goolen/undotbs01.dbf
/opt/oradata/goolen/sysaux01.dbf
/opt/oradata/goolen/user01.dbf
+++delete one of datafile

SQL> ! rm -rf /opt/oradata/goolen/user01.dbf

+++once the database is closed,the handle of the file was disappears
SQL> shut abort

ORACLE instance shut down.

+++we can use ext3grep to restore that file
+++scan file's inode and restore
+++scan deleted file from second inode
[root@goolen ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda2 23G 8.0G 14G 39% /
/dev/sda1 99M 12M 83M 12% /boot
tmpfs 506M 0 506M 0% /dev/shm

/dev/sdb1 9.2G 812M 8.0G 10% /opt/oradata

[root@goolen ~]# ext3grep /dev/sdb1 --ls --inode 2
Running ext3grep version 0.10.2
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 75
Loading group metadata... done
Minimum / maximum journal block: 1116 / 35028
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 2687232 = Sun Feb 1 10:27:12 1970
Journal transaction 76309 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 21855; min / max sequence numbers: 76087 / 86999
Inode is Allocated
Loading sdb1.ext3grep.stage2... done
The first block of the directory is 1110.
Inode 2 is directory "".
Directory block 1110:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 2 drwxr-xr-x .
1 2 d 2 drwxr-xr-x ..
2 3 d 11 drwx------ lost+found

3 end d 587521 drwxr-x--- goolen

[root@goolen ~]# ext3grep /dev/sdb1 --ls --inode 587521
Running ext3grep version 0.10.2
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 75
Minimum / maximum journal block: 1116 / 35028
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 2687232 = Sun Feb 1 10:27:12 1970
Journal transaction 76309 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 21855; min / max sequence numbers: 76087 / 86999
Inode is Allocated
Loading sdb1.ext3grep.stage2... done
The first block of the directory is 1191936.
Inode 587521 is directory "goolen".
Directory block 1191936:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 587521 drwxr-x--- .
1 2 d 2 drwxr-xr-x ..
2 3 r 587522 rrw-r----- control01.ctl
3 4 r 587523 rrw-r----- control02.ctl
4 5 r 587524 rrw-r----- control03.ctl
5 6 r 587525 rrw-r----- redo01.log
6 7 r 587526 rrw-r----- redo02.log
7 8 r 587527 rrw-r----- redo03.log
8 9 r 587528 rrw-r----- system01.dbf
9 10 r 587529 rrw-r----- undotbs01.dbf
10 11 r 587530 rrw-r----- sysaux01.dbf
11 end r 587531 rrw-r----- temp01.dbf

12 end r 587532 D 1388489259 Tue Dec 31 19:27:39 2013 rrw-r----- user01.dbf

[root@goolen ~]#
[root@goolen]# ext3grep /dev/sdb1 --restore-file goolen/user01.dbf
Running ext3grep version 0.10.2
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 75
Minimum / maximum journal block: 1116 / 35028
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1388358146 = Mon Dec 30 07:02:26 2013
Journal transaction 76309 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 21846; min / max sequence numbers: 75894 / 86813
Writing output to directory RESTORED_FILES/
Finding all blocks that might be directories.
D: block containing directory start, d: block containing more directory entries.
Each plus represents a directory start that references the same inode as a directory start that we found previously.
Searching group 0: DDD
Searching group 1:
Searching group 2:
Searching group 3:
Searching group 4:
Searching group 5: dd
Searching group 6:
Searching group 7: ddd
Searching group 8:
Searching group 9:
it to lost+found instead!
Writing analysis so far to 'sdb1.ext3grep.stage2'. Delete that file if you want to do this stage again.

Restoring goolen/user01.dbf

+++recovered data is saved in RESTORED_FILES
[root@goolen goolen]# pwd
/root/RESTORED_FILES/goolen
[root@goolen goolen]# ls -l
total 10264

-rw-r----- 1 root root 10493952 Dec 30 23:05 user01.dbf

+++copy this file to corresponding directory
[root@goolen goolen]# cp user01.dbf /opt/oradata/goolen/user01.dbf

[root@goolen goolen]# chown oracle:oinstall /opt/oradata/goolen/user01.dbf

+++recover database：
SQL> recover datafile 4;
Media recovery complete.
SQL> alter database open;

Database altered.

0 0