数字后缀名加密数据库恢复

联系:手机/微信(+86 17813235971) QQ(107644445)QQ咨询惜分飞

标题:数字后缀名加密数据库恢复

作者:惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]

一个oracle dmp文件被加密破坏的case,加密提示如下
20200306192501


20200306191213

通过工具分析发现该文件前面1M被破坏
20200306191553

通过我们工具对头部损坏的1M数据进行特殊处理,数据直接使用imp命令导入
20200306191709
如果你有各种被类似病毒加密的数据库(oracle,sql server,mysql),我们可以提供专业的恢复支持,实现不给黑客交钱的情况下,数据几乎完美恢复
Tel/微信:17813235971    Q Q:107644445 QQ咨询惜分飞    E-Mail:dba@xifenfei.com提供专业的恢复服务.

xfs删除数据文件恢复

联系:手机/微信(+86 17813235971) QQ(107644445)QQ咨询惜分飞

标题:xfs删除数据文件恢复

作者:惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]

在linux7的环境(xfs文件系统格式)中,由于误操作执行了rm -rf /操作,导致系统大部分文件被删除(oracle数据库相关文件).我们对其现场进行分析,确认相关数据在磁盘底层依旧存在
20191219042943


20191219043052


运气不错通过底层恢复,实现数据库完美open
20191219221348

oracle dmp被加密恢复

联系:手机/微信(+86 17813235971) QQ(107644445)QQ咨询惜分飞

标题:oracle dmp被加密恢复

作者:惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]

接到朋友恢复请求,oracle dmp文件被加密
20191124230422


通过分析文件发现该加密主要是对头尾部分block按照每16byte中8个byte置空和部分加密
20191124230702
20191124231600


通过进行恢复,对损坏部分进行跳过,剩余数据直接导入数据库,通过show=y测试数据可以正常入库,实现了dmp文件表数据的完美恢复
20191124231917
20191124232238


IMP-00098: INTERNAL ERROR: impgst2

联系:手机/微信(+86 17813235971) QQ(107644445)QQ咨询惜分飞

标题:IMP-00098: INTERNAL ERROR: impgst2

作者:惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]

有网友找到我们,imp导入数据库报IMP-00098: INTERNAL ERROR: impgst2错误,原始环境已经彻底破坏,无法通过数据文件恢复
20191120122739


20191120122750

通过分析,该表有218列

3240997713: TABLE "SWIP_ENTITY_TRX"
3241009738: BIND information for 218 columns
 col[  1] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[  2] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[  3] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[  4] type 1 max length 14 cset 873 (AL32UTF8) form 1
 col[  5] type 2 max length 22
 col[  6] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[  7] type 1 max length 20 cset 873 (AL32UTF8) form 1
 col[  8] type 1 max length 20 cset 873 (AL32UTF8) form 1
 col[  9] type 1 max length 20 cset 873 (AL32UTF8) form 1
 col[ 10] type 1 max length 20 cset 873 (AL32UTF8) form 1
 col[ 11] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 12] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 13] type 1 max length 20 cset 873 (AL32UTF8) form 1
 col[ 14] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 15] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 16] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 17] type 1 max length 200 cset 873 (AL32UTF8) form 1
 col[ 18] type 1 max length 200 cset 873 (AL32UTF8) form 1
 col[ 19] type 1 max length 20 cset 873 (AL32UTF8) form 1
 col[ 20] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[ 21] type 1 max length 200 cset 873 (AL32UTF8) form 1
 col[ 22] type 1 max length 200 cset 873 (AL32UTF8) form 1
 col[ 23] type 1 max length 20 cset 873 (AL32UTF8) form 1
 col[ 24] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[ 25] type 1 max length 14 cset 873 (AL32UTF8) form 1
 col[ 26] type 1 max length 14 cset 873 (AL32UTF8) form 1
 col[ 27] type 1 max length 14 cset 873 (AL32UTF8) form 1
 col[ 28] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 29] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 30] type 12 max length 7
 col[ 31] type 12 max length 7
 col[ 32] type 12 max length 7
 col[ 33] type 12 max length 7
 col[ 34] type 12 max length 7
 col[ 35] type 12 max length 7
 col[ 36] type 12 max length 7
 col[ 37] type 12 max length 7
 col[ 38] type 12 max length 7
 col[ 39] type 12 max length 7
 col[ 40] type 12 max length 7
 col[ 41] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 42] type 12 max length 7
 col[ 43] type 2 max length 22
 col[ 44] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[ 45] type 2 max length 22
 col[ 46] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[ 47] type 2 max length 22
 col[ 48] type 2 max length 22
 col[ 49] type 2 max length 22
 col[ 50] type 2 max length 22
 col[ 51] type 2 max length 22
 col[ 52] type 2 max length 22
 col[ 53] type 2 max length 22
 col[ 54] type 2 max length 22
 col[ 55] type 2 max length 22
 col[ 56] type 2 max length 22
 col[ 57] type 2 max length 22
 col[ 58] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[ 59] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[ 60] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[ 61] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[ 62] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[ 63] type 2 max length 22
 col[ 64] type 2 max length 22
 col[ 65] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[ 66] type 2 max length 22
 col[ 67] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[ 68] type 1 max length 2048 cset 873 (AL32UTF8) form 1
 col[ 69] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 70] type 1 max length 10 cset 873 (AL32UTF8) form 1
 col[ 71] type 1 max length 14 cset 873 (AL32UTF8) form 1
 col[ 72] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[ 73] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 74] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[ 75] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 76] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[ 77] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 78] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 79] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 80] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[ 81] type 12 max length 7
 col[ 82] type 1 max length 20 cset 873 (AL32UTF8) form 1
 col[ 83] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[ 84] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 85] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 86] type 1 max length 200 cset 873 (AL32UTF8) form 1
 col[ 87] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[ 88] type 1 max length 1 cset 873 (AL32UTF8) form 1
 col[ 89] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[ 90] type 1 max length 1000 cset 873 (AL32UTF8) form 1
 col[ 91] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[ 92] type 1 max length 100 cset 873 (AL32UTF8) form 1
 col[ 93] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[ 94] type 12 max length 7
 col[ 95] type 1 max length 1000 cset 873 (AL32UTF8) form 1
 col[ 96] type 1 max length 200 cset 873 (AL32UTF8) form 1
 col[ 97] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[ 98] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[ 99] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[100] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[101] type 1 max length 20 cset 873 (AL32UTF8) form 1
 col[102] type 96 max length 1 cset 873 (AL32UTF8) form 1
 col[103] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[104] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[105] type 1 max length 80 cset 873 (AL32UTF8) form 1
 col[106] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[107] type 12 max length 7
 col[108] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[109] type 96 max length 1 cset 873 (AL32UTF8) form 1
 col[110] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[111] type 96 max length 1 cset 873 (AL32UTF8) form 1
 col[112] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[113] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[114] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[115] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[116] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[117] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[118] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[119] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[120] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[121] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[122] type 96 max length 1 cset 873 (AL32UTF8) form 1
 col[123] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[124] type 96 max length 1 cset 873 (AL32UTF8) form 1
 col[125] type 2 max length 22
 col[126] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[127] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[128] type 12 max length 7
 col[129] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[130] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[131] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[132] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[133] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[134] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[135] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[136] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[137] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[138] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[139] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[140] type 1 max length 10 cset 873 (AL32UTF8) form 1
 col[141] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[142] type 1 max length 10 cset 873 (AL32UTF8) form 1
 col[143] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[144] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[145] type 96 max length 1 cset 873 (AL32UTF8) form 1
 col[146] type 1 max length 10 cset 873 (AL32UTF8) form 1
 col[147] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[148] type 2 max length 22
 col[149] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[150] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[151] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[152] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[153] type 12 max length 7
 col[154] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[155] type 1 max length 19 cset 873 (AL32UTF8) form 1
 col[156] type 1 max length 200 cset 873 (AL32UTF8) form 1
 col[157] type 1 max length 200 cset 873 (AL32UTF8) form 1
 col[158] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[159] type 1 max length 200 cset 873 (AL32UTF8) form 1
 col[160] type 1 max length 1 cset 873 (AL32UTF8) form 1
 col[161] type 96 max length 1 cset 873 (AL32UTF8) form 1
 col[162] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[163] type 96 max length 1 cset 873 (AL32UTF8) form 1
 col[164] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[165] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[166] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[167] type 1 max length 200 cset 873 (AL32UTF8) form 1
 col[168] type 1 max length 200 cset 873 (AL32UTF8) form 1
 col[169] type 1 max length 20 cset 873 (AL32UTF8) form 1
 col[170] type 2 max length 22
 col[171] type 2 max length 22
 col[172] type 2 max length 22
 col[173] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[174] type 12 max length 7
 col[175] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[176] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[177] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[178] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[179] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[180] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[181] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[182] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[183] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[184] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[185] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[186] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[187] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[188] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[189] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[190] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[191] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[192] type 2 max length 22
 col[193] type 12 max length 7
 col[194] type 12 max length 7
 col[195] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[196] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[197] type 1 max length 1 cset 873 (AL32UTF8) form 1
 col[198] type 12 max length 7
 col[199] type 2 max length 22
 col[200] type 96 max length 1 cset 873 (AL32UTF8) form 1
 col[201] type 96 max length 1 cset 873 (AL32UTF8) form 1
 col[202] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[203] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[204] type 1 max length 40 cset 873 (AL32UTF8) form 1
 col[205] type 96 max length 1 cset 873 (AL32UTF8) form 1
 col[206] type 1 max length 10 cset 873 (AL32UTF8) form 1
 col[207] type 1 max length 10 cset 873 (AL32UTF8) form 1
 col[208] type 12 max length 7
 col[209] type 1 max length 14 cset 873 (AL32UTF8) form 1
 col[210] type 1 max length 14 cset 873 (AL32UTF8) form 1
 col[211] type 1 max length 12 cset 873 (AL32UTF8) form 1
 col[212] type 1 max length 24 cset 873 (AL32UTF8) form 1
 col[213] type 96 max length 1 cset 873 (AL32UTF8) form 1
 col[214] type 1 max length 100 cset 873 (AL32UTF8) form 1
 col[215] type 2 max length 22
 col[216] type 1 max length 100 cset 873 (AL32UTF8) form 1
 col[217] type 1 max length 100 cset 873 (AL32UTF8) form 1
 col[218] type 1 max length 100 cset 873 (AL32UTF8) form 1
Conventional export
3241011300: start of table data

由于某种原因导致该dmp异常了,而且客户的主要数据都在这个表里面,因此找我们进行恢复处理.通过工具扫描,确定dmp基本上是好的.进行二次处理,把该dmp中这个表重新恢复成dmp文件,然后导入数据库,完成恢复(包括解决某些工具有汉字乱码问题,和sqlldr换行导入问题等)
20191120145616


再一起asm disk被格式化成ext3文件系统故障恢复

联系:手机/微信(+86 17813235971) QQ(107644445)QQ咨询惜分飞

标题:再一起asm disk被格式化成ext3文件系统故障恢复

作者:惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]

国庆节前夕接到朋友求救电话asm disk被格式化成ext3格式了,具体操作如下
20191006205129


20191006205203

并且把这个分区直接挂载到/目录
20191006205239

由于/被挂载新格式化的控盘,导致asm磁盘组访问其他盘报错

Sun Sep 29 18:15:02 2019
Errors in file /u01/app/grid/diag/asm/+asm/+ASM1/trace/+ASM1_b000_8094.trc:
ORA-15025: could not open disk "/dev/asmdisk/sdh"
ORA-27041: unable to open file
Linux-x86_64 Error: 2: No such file or directory
Additional information: 3
Errors in file /u01/app/grid/diag/asm/+asm/+ASM1/trace/+ASM1_b000_8094.trc:
ORA-15025: could not open disk "/dev/asmdisk/sdh"
ORA-27041: unable to open file
Linux-x86_64 Error: 2: No such file or directory
Additional information: 3
WARNING: cache failed reading from group=1(DATA) fn=9 blk=0 count=1 from 
disk= 5 (DATA_0005) kfkist=0x20 status=0x02 osderr=0x0 file=kfc.c line=11596
Errors in file /u01/app/grid/diag/asm/+asm/+ASM1/trace/+ASM1_b000_8094.trc:
ORA-15025: could not open disk "/dev/asmdisk/sdh"
ORA-27041: unable to open file
Linux-x86_64 Error: 2: No such file or directory
Additional information: 3
ORA-15080: synchronous I/O operation to a disk failed
WARNING: cache succeeded reading from group=1(DATA) fn=9 blk=0 count=1 from 
disk= 7 (DATA_0007) kfkist=0x20 status=0x01 osderr=0x0 file=kfc.c line=11637
Errors in file /u01/app/grid/diag/asm/+asm/+ASM1/trace/+ASM1_b000_8094.trc:
ORA-15025: could not open disk "/dev/asmdisk/sdh"
ORA-27041: unable to open file
Linux-x86_64 Error: 2: No such file or directory
Additional information: 3
WARNING: PST-initiated drop of 1 disk(s) in group 1(.2380027701))

重启系统之后,重试mount 磁盘组

GMON dismounting group 1 at 18 for pid 31, osid 44279
NOTE: Disk DATA_0000 in mode 0x7f marked for de-assignment
NOTE: Disk DATA_0001 in mode 0x7f marked for de-assignment
NOTE: Disk DATA_0002 in mode 0x7f marked for de-assignment
NOTE: Disk DATA_0003 in mode 0x7f marked for de-assignment
NOTE: Disk DATA_0004 in mode 0x1 marked for de-assignment
NOTE: Disk DATA_0005 in mode 0x7f marked for de-assignment
NOTE: Disk DATA_0006 in mode 0x7f marked for de-assignment
NOTE: Disk DATA_0007 in mode 0x7f marked for de-assignment
NOTE: Disk  in mode 0x7f marked for de-assignment
NOTE: Disk DATA_0009 in mode 0x7f marked for de-assignment
NOTE: Disk DATA_0010 in mode 0x7f marked for de-assignment
NOTE: Disk DATA_0011 in mode 0x7f marked for de-assignment
NOTE: Disk DATA_0012 in mode 0x7f marked for de-assignment
NOTE: Disk DATA_0013 in mode 0x7f marked for de-assignment
NOTE: Disk DATA_0014 in mode 0x7f marked for de-assignment
ERROR: diskgroup DATA was not mounted
ORA-15032: not all alterations performed
ORA-15040: diskgroup is incomplete
ORA-15042: ASM disk "8" is missing from group number "1" 
ERROR: ALTER DISKGROUP DATA MOUNT  /* asm agent *//* {1:2587:2} */

由于sdb(asm disk 8)被格式化,导致data磁盘组无法正常mount.这个客户运气比较好data 磁盘组是normal模式,但是由于mount到/,导致disk 4被强制drop,因此无法mount成功,但是通过一系列处理数据实现完美恢复,0数据丢失
20191006211707


如果磁盘组是外部冗余,请参考:
又一例asm格式化文件系统恢复
一次完美的asm disk被格式化ntfs恢复
oracle asm disk格式化恢复—格式化为ext4文件系统
oracle asm disk格式化恢复—格式化为ntfs文件系统