标签云
asm恢复 bbed bootstrap$ dul kcbzib_kcrsds_1 kccpb_sanity_check_2 kcratr_nab_less_than_odr MySQL恢复 obet ORA-00312 ORA-00704 ORA-00742 ORA-01110 ORA-01200 ORA-01555 ORA-01578 ORA-01595 ORA-600 2662 ORA-600 2663 ORA-600 3020 ORA-600 4000 ORA-600 4137 ORA-600 4193 ORA-600 4194 ORA-600 16703 ORA-600 kcbzib_kcrsds_1 ORA-600 KCLCHKBLK_4 ORA-600 kcratr_nab_less_than_odr ORA-15042 ORA-15196 ORACLE 12C oracle dul ORACLE PATCH Oracle Recovery Tools oracle加密恢复 oracle勒索 oracle勒索恢复 oracle异常恢复 ORACLE恢复 Oracle 恢复 ORACLE数据库恢复 oracle碎片 OSD-04016 YOUR FILES ARE ENCRYPTED 比特币加密文章分类
- MongoDB (1)
- MongoDB恢复 (1)
- Others (2)
- 中间件 (2)
- WebLogic (2)
- 操作系统 (112)
- 数据库 (1,883)
- DB2 (22)
- MySQL (82)
- Oracle (1,708)
- Data Guard (53)
- EXADATA (8)
- GoldenGate (24)
- ORA-xxxxx (168)
- ORACLE 12C (72)
- ORACLE 18C (6)
- ORACLE 19C (15)
- ORACLE 21C (3)
- Oracle 23ai (8)
- Oracle ASM (72)
- Oracle Bug (8)
- Oracle RAC (56)
- Oracle 安全 (6)
- Oracle 开发 (28)
- Oracle 监听 (29)
- Oracle备份恢复 (662)
- Oracle安装升级 (108)
- Oracle性能优化 (62)
- 专题索引 (5)
- 勒索恢复 (91)
- PostgreSQL (37)
- pdu工具 (7)
- PostgreSQL恢复 (13)
- SQL Server (34)
- SQL Server恢复 (14)
- TimesTen (7)
- 达梦数据库 (5)
- 达梦恢复 (3)
- 生活娱乐 (2)
- 至理名言 (11)
- 虚拟化 (2)
- VMware (2)
- 软件开发 (51)
- Asp.Net (9)
- JavaScript (12)
- PHP (2)
- 小工具 (34)
- MongoDB (1)
-
最近发表
- aix平台Oracle数据库由于断电无法启动故障处理
- 断电引起ORA-600 3005故障处理
- 记录一次云存储资源到期之后引起的数据库恢复
- Firebird 损坏数据库数据抢救工具—firebirdext
- Oracle 19c 202610补丁(RUs+OJVM)-19.33
- 由于con$.con#值达到极限,触发数据库增加约束报ORA-600 12807错误
- MongoDB 离线提取工具—mongoext
- .bres勒索病毒加密数据库dmp文件可恢复
- ORA-600 krsm_mrp_rebuild_lf_list.lno_mismatch
- 记录一次0丢失的ORA-00354: 损坏重做日志块标头故障恢复
- 不当数据库恢复操作导致一个月数据丢失
- obet快速修复oracle 位图损坏块
- 不太常见的10.2.0.1的oracle redo损坏恢复
- obet forcecopy功能抢救硬件故障中的数据文件
- kcratr_nab_less_than_odr和system坏块故障处理
- 通过obet 恢复system坏块,打开数据库
- obet dbv功能完整说明
- 分享一例运行在aix上的sap系统数据库恢复过程
- OBET-Oracle Block Editor Tool使用说明
- 几乎动用了所有手段的Oracle故障恢复
分类目录归档:数据库
OraFHR快速open被勒索加密破坏的Oracle数据库
今天客户一个12.2的库,被.[[yatesnet@cock.li]].wman加密

通过obet工具分析(obet实现对数据文件坏块检测功能,确认每个文件损坏63个block

而且数据库版本是12.2符合Oracle数据库被勒索加密一键open工具–OraFHR重构文件头的条件,对其进行重构

然后根据软件提示命令操作直接打开数据库

obet一键恢复offline数据文件
客户有一个数据库由于异常断电之后无法正常启动,自行尝试恢复之后但是没有open成功,让可以通过Oracle数据库异常恢复检查脚本(Oracle Database Recovery Check)脚本收集信息进行评估,发现两个问题:
1. 根据查询信息确认users01.dbf(file# 4)文件处于offline状态,而且checkpoint scn明显小于其他文件

2. 通过分析alert日志确认客户在尝试offline file 4 之后open数据库报ORA-600 4194错误,数据库没有open成功
Mon Mar 30 06:26:30 2026 Starting ORACLE instance (normal) Mon Mar 30 06:27:00 2026 ALTER DATABASE DATAFILE 4 OFFLINE DROP Completed: ALTER DATABASE DATAFILE 4 OFFLINE DROP Mon Mar 30 06:27:26 2026 ALTER DATABASE OPEN Beginning crash recovery of 1 threads parallel recovery started with 7 processes Started redo scan Completed redo scan read 88 KB redo, 103 data blocks need recovery Started redo application at Thread 1: logseq 3, block 3 Recovery of Online Redo Log: Thread 1 Group 3 Seq 3 Reading mem 0 Mem# 0: /home/oracle/app/oracle/oradata/orcl/redo03.log Completed redo application of 0.07MB Completed crash recovery at Thread 1: logseq 3, block 180, scn 415466134 103 data blocks read, 103 data blocks written, 88 redo k-bytes read Mon Mar 30 06:27:28 2026 Thread 1 advanced to log sequence 4 (thread open) Thread 1 opened at log sequence 4 Current log# 1 seq# 4 mem# 0: /home/oracle/app/oracle/oradata/orcl/redo01.log Successful open of redo thread 1 MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set Mon Mar 30 06:27:28 2026 SMON: enabling cache recovery Successfully onlined Undo Tablespace 2. Verifying file header compatibility for 11g tablespace encryption.. Verifying 11g file header compatibility for tablespace encryption completed SMON: enabling tx recovery Database Characterset is ZHS16GBK No Resource Manager plan active Errors in file /home/oracle/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_smon_17628.trc(incident=186839): ORA-00600: internal error code, arguments: [4194], [], [], [], [], [], [], [], [], [], [], [] Incident details in: /home/oracle/app/oracle/diag/rdbms/orcl/orcl/orcl_smon_17628_i186839.trc Exception [type: SIGBUS, Non-existent physical address] [ADDR:0x6C0C4B62] [PC:0x2297750, kgegpa()+40] Exception [type: SIGBUS, Non-existent physical address] [ADDR:0x6C0C4B62] [PC:0x229597B, kgebse()+279] Mon Mar 30 06:27:28 2026 PMON (ospid: 17604): terminating the instance due to error 397 Errors in file /home/oracle/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_smon_17628.trc: ORA-00328: archived log ends at change 415466135, need later change 415466136 ORA-00334: archived log: '/home/oracle/app/oracle/oradata/orcl/redo03.log' ORA-00600: internal error code, arguments: [4194], [], [], [], [], [], [], [], [], [], [], [] Instance terminated by PMON, pid = 17604
接手这个故障之后,由于数据库是非归档模式,而且已经被屏蔽一致性强制打开过(open过程没成功),redo已经被clear过,因此基于这样的情况,直接上obet工具(Oracle Block Editor Tool修改file# 4的文件头状态
obet修复之前文件状态
STATUS CHECKPOINT_TIME FUZ CHECKPOINT_CHANGE# ROW_NUM ------- ---------------------------------------- --- ------------------ ---------------- OFFLINE 2026-03-30 06:24:41 YES 415446014 1 ONLINE 2026-03-30 06:28:26 YES 415486184 7
obet修改文件头操作
OBET> open listfile.txt
Loaded 8 files from datafile list 'listfile.txt'.
OBET> info
Loaded files (2 total):
----------------------------------------
Number Path
----------------------------------------
1 /home/oracle/app/oracle/oradata/orcl/system01.dbf
4 /opt/oradata/orcl/users01.dbf
----------------------------------------
OBET> set mode edit
mode set to: edit
OBET> set file 4
filename set to: /opt/oradata/orcl/users01.dbf (file#4)
OBET> backup block 1
Created backup directory: backup_blk
Successfully backed up block 1 from current file to /tmp/backup_blk/users01.dbf_1.20260331092333
OBET> copy chkscn file 1 to file 4
Confirm Modify chkscn:
Source: file#1 (/home/oracle/app/oracle/oradata/orcl/system01.dbf)
Target: file#4 (/opt/oradata/orcl/users01.dbf)
Proceed? (Y/YES to confirm): y
Successfully copied checkpoint SCN information from file#1 to file#4.
OBET> exit
Exiting OBET.
再次查询文件头scn信息
STATUS CHECKPOINT_TIME FUZ CHECKPOINT_CHANGE# ROW_NUM ------- ---------------------------------------- --- ------------------ ---------------- OFFLINE 2026-03-30 06:28:26 NO 415486184 1 ONLINE 2026-03-30 06:28:26 YES 415486184 7
尝试online文件,并open库成功
SQL> recover datafile 4; Media recovery complete. SQL> alter database datafile 4 online; Database altered. SQL> alter database open; Database altered.
记录一次win删除数据文件完美恢复案例
有客户在操作系统层面删除了四个数据文件(数据库在关闭情况下直接删除物理文件),然后offline,启动数据库,结果发现被删除的数据文件是业务表空间的,导致大量业务访问报错

通过数据库层面查询确认这些文件已经不存在

对于这样的情况,先尝试从文件系统层面尝试反删除恢复文件

由于删除文件之后,启动了数据库并写入了一些日志和数据导致被删除的文件的元数据信息彻底丢失,这种情况下基于文件系统的反删除恢复肯定无法需要的数据,对于这种情况,考虑进行碎片层面恢复,以前有过类似案例:
win系统删除oracle数据文件恢复
Oracle 数据文件大小为0kb或者文件丢失恢复
删除数据库文件并部分覆盖情况下Oracle恢复
通过底层扫描发现需要恢复的文件头部信息丢失,其他block完整(该文件本身不大,只有100M),扫描出来的数据块类似这样的结果


这里比较幸运,丢失的block为1-3,也就是涉及文件头和一些位图信息,通过以前自研的OraFHR工具(Oracle数据库被勒索加密一键open工具–OraFHR)进行重构文件头,再通过oracle recovery tools工具进行文件头的一些修复工作

再重建控制文件打开数据库,并完美导出数据,实现数据0丢失恢复



加我微信(17813235971)
加我QQ(107644445)

