基於檔案描述符的恢復

在nuix中當程式開啟了某個檔案時，只要該程式保持開啟該檔案，即使將其刪除，它依然存在於磁碟中。這意味著，程式並不知道檔案已經被刪除，它仍然可以向開啟該檔案時提供給它的檔案描述符進行讀取和寫入。除了該程式之外，這個檔案是不可見的，因為已經刪除了其相應的目錄條目。該檔案佔用的儲存空間並不會被其他應用程式所覆蓋，透過df命令檢視，剩餘空間沒有發生改變。因此，切記作業系統中誤刪檔案，不要急著關閉應用程式，此時根據檔案描述符很可以將誤刪的檔案恢復至原來位置。

部分資料檔案丟失的恢復：

檢視一下資料庫的資料檔案路徑

SQL> select FILE#,NAME,STATUS from v$datafile;

FILE# NAME STATUS

---------- ----------------------------------------------- -------

1 /u01/app/oracle/oradata/orcl_dup/system01.dbf SYSTEM

3 /u01/app/oracle/oradata/orcl_dup/sysaux01.dbf ONLINE

4 /u01/app/oracle/oradata/orcl_dup/users01.dbf ONLINE

5 /u01/app/oracle/oradata/orcl_dup/example01.dbf ONLINE

6 /u01/app/oracle/oradata/orcl_dup/tts01.dbf ONLINE

7 /u01/app/oracle/oradata/orcl_dup/tts02.dbf ONLINE

8 /u01/app/oracle/oradata/orcl_dup/undotbs001.dbf ONLINE

模擬損壞，刪除user01.dbf資料檔案

SQL> !rm -rf /u01/app/oracle/oradata/orcl_dup/users01.dbf

用scott登入使用者測試：（該資料庫中scott使用者預設表空間是users）

SQL> conn scott/oracle

Connected.

SQL> select username,default_tablespace from user_users;

USERNAME DEFAULT_TABLESPACE

------------------------------ ------------------------------

SCOTT USERS

SQL> create table test_user01 as select * from dept;

create table test_user01 as select * from dept

*

ERROR at line 1:

ORA-01116: error in opening database file 4

ORA-01110: data file 4: '/u01/app/oracle/oradata/orcl_dup/users01.dbf'

ORA-27041: unable to open file

Linux Error: 2: No such file or directory

Additional information: 3

此時不要關閉資料庫，作業系統查詢lgwr程式：

[root@node1 rman_dest]# ps -ef|grep lgwr|grep -v grep

oracle 4675 1 0 10:24 ? 00:00:00 ora_lgwr_orcl_dup

[root@node1 rman_dest]# lsof -a -p 4675|grep deleted

根據程式號，列出4675程式開啟的檔案

oracle 4675 oracle 7u REG 253,0 0 820408 /u01/app/oracle/10.2.0/db_1/dbs/lkinstorcl_dup (deleted)

oracle 4675 oracle 24u REG 253,0 191373312 688599 /u01/app/oracle/oradata/orcl_dup/users01.dbf (deleted)

[root@node1 rman_dest]# cd /proc/4675/fd/

複製檔案描述符，恢復資料檔案

[root@node1 fd]# cp 24 /u01/app/oracle/oradata/orcl_dup/users01.dbf

[root@node1 fd]# cd /u01/app/oracle/oradata/orcl_dup/

修改一下被恢復檔案的許可權和使用者組

[root@node1 orcl_dup]# ll users01.dbf

-rw-r----- 1 root root 191373312 Jul 8 15:53 users01.dbf

[root@node1 orcl_dup]# chown oracle:oinstall users01.dbf

[root@node1 orcl_dup]# ll users01.dbf

-rw-r----- 1 oracle oinstall 191373312 Jul 8 15:53 users01.dbf

登入資料庫進行恢復：

SQL> conn / as sysdba

Connected.

SQL> alter database datafile 4 offline;

Database altered.

SQL> recover datafile 4;

Media recovery complete.

SQL> alter database datafile 4 online;

Database altered.

恢復完成，用scott使用者進行測試

SQL> conn scott/oracle

Connected.

SQL> create table test_user01 as select * from dept;

Table created.

SQL> commit;

Commit complete.

所有資料檔案都丟失：

如若system表空間中的資料檔案丟失，需關閉資料庫進行恢復，為安全起見，再做該測試前請做有效的資料庫完全備份，本次測試將控制檔案和REDO日誌一併刪除，不影響測試結果。

模擬損壞

[root@node1 ~]# rm -rf /u01/app/oracle/oradata/orcl_dup/*

SQL> select FILE#,NAME,STATUS from v$datafile;

FILE# NAME STATUS

---------- ----------------------------------------------- -------

1 /u01/app/oracle/oradata/orcl_dup/system01.dbf SYSTEM

3 /u01/app/oracle/oradata/orcl_dup/sysaux01.dbf ONLINE

4 /u01/app/oracle/oradata/orcl_dup/users01.dbf ONLINE

5 /u01/app/oracle/oradata/orcl_dup/example01.dbf ONLINE

6 /u01/app/oracle/oradata/orcl_dup/tts01.dbf ONLINE

7 /u01/app/oracle/oradata/orcl_dup/tts02.dbf ONLINE

8 /u01/app/oracle/oradata/orcl_dup/undotbs001.dbf ONLINE

7 rows selected.

檢視lgwr程式號

[oracle@node1 ~]$ ps -ef | grep lgwr | grep -v grep

oracle 5843 1 0 16:54 ? 00:00:00 ora_lgwr_orcl_dup

根據程式號找到相應的檔案描述符，複製恢復

[root@node1 ~]# lsof -a -p 5843 | grep deleted

oracle 5843 oracle 7u REG 253,0 0 820408 /u01/app/oracle/10.2.0/db_1/dbs/lkinstorcl_dup (deleted)

oracle 5843 oracle 16u REG 253,0 7389184 688483 /u01/app/oracle/oradata/orcl_dup/control01.ctl (deleted)

oracle 5843 oracle 17u REG 253,0 7389184 688484 /u01/app/oracle/oradata/orcl_dup/control02.ctl (deleted)

oracle 5843 oracle 18u REG 253,0 7389184 688485 /u01/app/oracle/oradata/orcl_dup/control03.ctl (deleted)

oracle 5843 oracle 19u REG 253,0 20972032 688486 /u01/app/oracle/oradata/orcl_dup/redo01.log (deleted)

oracle 5843 oracle 20u REG 253,0 20972032 688488 /u01/app/oracle/oradata/orcl_dup/redo03.log (deleted)

oracle 5843 oracle 21u REG 253,0 20972032 688487 /u01/app/oracle/oradata/orcl_dup/redo02.log (deleted)

oracle 5843 oracle 22u REG 253,0 524296192 688489 /u01/app/oracle/oradata/orcl_dup/system01.dbf (deleted)

oracle 5843 oracle 23u REG 253,0 346038272 688490 /u01/app/oracle/oradata/orcl_dup/sysaux01.dbf (deleted)

oracle 5843 oracle 24u REG 253,0 104865792 688491 /u01/app/oracle/oradata/orcl_dup/example01.dbf (deleted)

oracle 5843 oracle 25u REG 253,0 20979712 688471 /u01/app/oracle/oradata/orcl_dup/tts01.dbf (deleted)

oracle 5843 oracle 26u REG 253,0 20979712 688492 /u01/app/oracle/oradata/orcl_dup/tts02.dbf (deleted)

oracle 5843 oracle 27u REG 253,0 104865792 688493 /u01/app/oracle/oradata/orcl_dup/undotbs001.dbf (deleted)

[root@node1 ~]# cd /proc/5843/fd/

[root@node1 fd]# ls

0 10 12 14 16 18 2 21 23 25 27 3 5 7 9

1 11 13 15 17 19 20 22 24 26 28 4 6 8

[root@node1 fd]# cp 16 /u01/app/oracle/oradata/orcl_dup/control01.ctl

[root@node1 fd]# cp 17 /u01/app/oracle/oradata/orcl_dup/control02.ctl

[root@node1 fd]# cp 18 /u01/app/oracle/oradata/orcl_dup/control03.ctl

[root@node1 fd]# cp 19 /u01/app/oracle/oradata/orcl_dup/redo01.log

^[[A[root@node1 fcp 20 /u01/app/oracle/oradata/orcl_dup/redo03.log

[root@node1 fd]# cp 20 /u01/app/oracle/oradata/orcl_dup/redo03.log

[root@node1 fd]# cp 21 /u01/app/oracle/oradata/orcl_dup/redo02.log

[root@node1 fd]# cp 22 /u01/app/oracle/oradata/orcl_dup/system01.dbf

[root@node1 fd]# cp 23 /u01/app/oracle/oradata/orcl_dup/sysaux01.dbf

[root@node1 fd]# cp 24 /u01/app/oracle/oradata/orcl_dup/example01.dbf

[root@node1 fd]# cp 25 /u01/app/oracle/oradata/orcl_dup/tts01.dbf

[root@node1 fd]# cp 26 /u01/app/oracle/oradata/orcl_dup/tts02.dbf

[root@node1 fd]# cp 27 /u01/app/oracle/oradata/orcl_dup/undotbs001.dbf

注意觀察，發現user01.dbf並未找到，因為當前測試資料庫並未有使用者讀寫資料，user表空間沒有活躍的事物，即使資料檔案user01.dbf被刪除，資料庫並未開始讀寫資料，所以user01.dbf的資料檔案並不在lgwr程式程式鎖定的檔案描述符內，需查詢dbw程式

[root@node1 fd]# ps -ef | grep dbw | grep -v grep

root 5981 4616 0 17:04 pts/1 00:00:00 grep dbw

[root@node1 fd]# lsof -a -p 5841| grep deleted

oracle 5841 oracle 7u REG 253,0 0 820408 /u01/app/oracle/10.2.0/db_1/dbs/lkinstorcl_dup (deleted)

oracle 5841 oracle 16u REG 253,0 7389184 688483 /u01/app/oracle/oradata/orcl_dup/control01.ctl (deleted)

oracle 5841 oracle 17u REG 253,0 7389184 688484 /u01/app/oracle/oradata/orcl_dup/control02.ctl (deleted)

oracle 5841 oracle 18u REG 253,0 7389184 688485 /u01/app/oracle/oradata/orcl_dup/control03.ctl (deleted)

oracle 5841 oracle 19uW REG 253,0 524296192 688489 /u01/app/oracle/oradata/orcl_dup/system01.dbf (deleted)

oracle 5841 oracle 20uW REG 253,0 346038272 688490 /u01/app/oracle/oradata/orcl_dup/sysaux01.dbf (deleted)

oracle 5841 oracle 21uW REG 253,0 104865792 688491 /u01/app/oracle/oradata/orcl_dup/example01.dbf (deleted)

oracle 5841 oracle 22uW REG 253,0 20979712 688471 /u01/app/oracle/oradata/orcl_dup/tts01.dbf (deleted)

oracle 5841 oracle 23uW REG 253,0 20979712 688492 /u01/app/oracle/oradata/orcl_dup/tts02.dbf (deleted)

oracle 5841 oracle 24uW REG 253,0 104865792 688493 /u01/app/oracle/oradata/orcl_dup/undotbs001.dbf (deleted)

oracle 5841 oracle 25uW REG 253,0 22028288 688514 /u01/app/oracle/oradata/orcl_dup/temp01.dbf (deleted)

oracle 5841 oracle 27uW REG 253,0 191373312 688500 /u01/app/oracle/oradata/orcl_dup/users01.dbf (deleted)

[root@node1 fd]# lsof -a -p 5841| grep deleted

[root@node1 fd]# cd /proc/5841/fd/

[root@node1 fd]# ls

0 10 12 14 16 18 2 21 23 25 27 4 6 8

1 11 13 15 17 19 20 22 24 26 3 5 7 9

[root@node1 fd]# cp 27 /u01/app/oracle/oradata/orcl_dup/users01.dbf

[root@node1 fd]# cd /u01/app/oracle/oradata/orcl_dup/

修改相應的使用者組和許可權

[root@node1 orcl_dup]# ll

total 1367108

-rw-r----- 1 root root 7389184 Jul 8 16:57 control01.ctl

-rw-r----- 1 root root 7389184 Jul 8 16:58 control02.ctl

-rw-r----- 1 root root 7389184 Jul 8 16:58 control03.ctl

-rw-r----- 1 root root 104865792 Jul 8 17:02 example01.dbf

-rw-r----- 1 root root 20972032 Jul 8 16:58 redo01.log

-rw-r----- 1 root root 20972032 Jul 8 16:59 redo02.log

-rw-r----- 1 root root 20972032 Jul 8 16:59 redo03.log

-rw-r----- 1 root root 346038272 Jul 8 17:02 sysaux01.dbf

-rw-r----- 1 root root 524296192 Jul 8 17:00 system01.dbf

-rw-r----- 1 root root 20979712 Jul 8 17:02 tts01.dbf

-rw-r----- 1 root root 20979712 Jul 8 17:02 tts02.dbf

-rw-r----- 1 root root 104865792 Jul 8 17:03 undotbs001.dbf

-rw-r----- 1 root root 191373312 Jul 8 17:06 users01.dbf

[root@node1 orcl_dup]# chown oracle:oinstall *

[root@node1 orcl_dup]# ll

total 1367108

-rw-r----- 1 oracle oinstall 7389184 Jul 8 16:57 control01.ctl

-rw-r----- 1 oracle oinstall 7389184 Jul 8 16:58 control02.ctl

-rw-r----- 1 oracle oinstall 7389184 Jul 8 16:58 control03.ctl

-rw-r----- 1 oracle oinstall 104865792 Jul 8 17:02 example01.dbf

-rw-r----- 1 oracle oinstall 20972032 Jul 8 16:58 redo01.log

-rw-r----- 1 oracle oinstall 20972032 Jul 8 16:59 redo02.log

-rw-r----- 1 oracle oinstall 20972032 Jul 8 16:59 redo03.log

-rw-r----- 1 oracle oinstall 346038272 Jul 8 17:02 sysaux01.dbf

-rw-r----- 1 oracle oinstall 524296192 Jul 8 17:00 system01.dbf

-rw-r----- 1 oracle oinstall 20979712 Jul 8 17:02 tts01.dbf

-rw-r----- 1 oracle oinstall 20979712 Jul 8 17:02 tts02.dbf

-rw-r----- 1 oracle oinstall 104865792 Jul 8 17:03 undotbs001.dbf

-rw-r----- 1 oracle oinstall 191373312 Jul 8 17:06 users01.dbf

重啟資料庫（重啟前一定確定自己資料庫中被刪除的檔案已經全部被複制至原路徑下，複製資料庫一旦關閉，釋放鎖定狀態，被刪除的檔案將不再存在，只能透過其他方式進行恢復資料庫）

SQL> shutdown abort;

ORACLE instance shut down.

SQL> startup

ORACLE instance started.

Total System Global Area 167772160 bytes

Fixed Size 1218316 bytes

Variable Size 71305460 bytes

Database Buffers 92274688 bytes

Redo Buffers 2973696 bytes

Database mounted.

Database opened.

Scott使用者測試

SQL> conn scott/oracle

Connected.

SQL> drop table test_user01 purge;

Table dropped.

SQL> commit;

Commit complete.

基於檔案描述符的恢復