千家信息网

如何通过BBED找回删除数据

发表于:2024-09-23 作者:千家信息网编辑
千家信息网最后更新 2024年09月23日,项目案例:客户删除delete了重要数据,无备份,客户联系我,要求恢复相应数据。本次通过实验方式重现客户现场。备份高于一切,首先备份,再操作创建表格:create table king(age num
千家信息网最后更新 2024年09月23日如何通过BBED找回删除数据

项目案例:客户删除delete了重要数据,无备份,客户联系我,要求恢复相应数据。本次通过实验方式重现客户现场。备份高于一切,首先备份,再操作

创建表格:

  1. create table king(age number,name varchar2(20));

  2. insert into king values(20,'rick');

  3. insert into king values(30,'wuzy');

  4. commit;

  5. select dbms_rowid.rowid_relative_fno(rowid) rel_fno,dbms_rowid.rowid_block_number(rowid) blockno from king

    4 303

  6. delete from king where age=30;

  7. commit

结果:

bbed恢复(建议关闭数据库):

set file 4,303

find /c wuzy

File: /u01/app/oracle/oradata/orcl/users01.dbf (4)
Block: 303 Offsets: 8173 to 8191 Dba:0x0100012f
------------------------------------------------------------------------
77757a79 2c000202 c1150472 69636b01 064a2f

p kdbr

BBED> p kdbr
sb2 kdbr[0] @118 8077
sb2 kdbr[1] @120 8066

BBED> p *kdbr[0]
rowdata[11]
-----------
ub1 rowdata[11] @8177 0x2c

BBED> p *kdbr[1]
rowdata[0]
----------
ub1 rowdata[0] @8166 0x2c

BBED> set dba 4,303 offset 8173
DBA 0x0100012f (16777519 4,303)
OFFSET 8173

BBED> d /v dba 4,303 offset 8173
File: /u01/app/oracle/oradata/orcl/users01.dbf (4)
Block: 303 Offsets: 8173 to 8191 Dba:0x0100012f
-------------------------------------------------------
77757a79 2c000202 c1150472 69636b01 l wuzy,....rick.
06c42f l .

<16 bytes per line>

BBED> d /v offset 8166
File: /u01/app/oracle/oradata/orcl/users01.dbf (4)
Block: 303 Offsets: 8166 to 8191 Dba:0x0100012f
-------------------------------------------------------
3c020202 c11f0477 757a792c 000202c1 l <....wuzy,...
15047269 636b0106 c42f l ..rick..

<16 bytes per line>

BBED> modify /x 2c
File: /u01/app/oracle/oradata/orcl/users01.dbf (4)
Block: 303 Offsets: 8166 to 8191 Dba:0x0100012f
------------------------------------------------------------------------
2c020202 c11f0477 757a792c 000202c1 15047269 636b0106 c42f

<32 bytes per line>

BBED> sum apply
Check value for File 4, Block 303:
current = 0x6436, required = 0x6436

结果:

删减数据已经恢复。

注意:3C是已经删除的数据 2C是没有删除数据

0