分类目录归档：数据库

ORA-00704 ORA-00943故障恢复

发表于 2021 年 5 月 9 日 由 惜分飞

有朋友找到我们,他们数据库启动报ORA-01092 ORA-00704 ORA-00702错，使用自研的ORA-702_Recovery Tool小工具可以实现一键恢复,下载地址：ORA-702_Recovery下载
ORA-01092-ORA-00704-ORA-00702

MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set
SMON: enabling cache recovery
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_4868.trc:
ORA-00704: 引导程序进程失败
ORA-00702: 引导程序版本 '' 与版本 '8.0.0.0.0' 不一致
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_4868.trc:
ORA-00704: 引导程序进程失败
ORA-00702: 引导程序版本 '' 与版本 '8.0.0.0.0' 不一致
Error 704 happened during db open, shutting down database
USER (ospid: 4868): terminating the instance due to error 704
Thu May 06 09:20:28 2021
Instance terminated by USER, pid = 4868
ORA-1092 signalled during: ALTER DATABASE OPEN...

以前有过类似恢复经历:
2019恢复第一单—ORA-704-ORA-702恢复
恶意删除bootstrap$导致数据库无法正常启动
ORA-00702: bootstrap verison ” inconsistent with version ’8.0.0.0.0′
这个问题本身相对比较简单,客户根据网上介绍,自行尝试恢复,经过客户一系列的处理之后,数据库启动报ORA-00704 ORA-00943错

MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set
SMON: enabling cache recovery
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_6600.trc:
ORA-00704: 引导程序进程失败
ORA-00943: 簇不存在
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_6600.trc:
ORA-00704: 引导程序进程失败
ORA-00943: 簇不存在
Error 704 happened during db open, shutting down database
USER (ospid: 6600): terminating the instance due to error 704
Thu May 06 22:17:18 2021
Instance terminated by USER, pid = 6600
ORA-1092 signalled during: ALTER DATABASE OPEN...
opiodr aborting process unknown ospid (6600) as a result of ORA-1092

因为根据最初的错误知道是bootstrap$异常,现在报该错误,应该是bootstrap$没有处理正确导致,我们通过对bootstrap$重新处理,数据库直接open成功
open

发表在 Oracle备份恢复 | 标签为 , , | 评论关闭

win 11.2.0.4打patch后服务无法正常启动处理

发表于 2021 年 5 月 8 日 由 惜分飞

最近一直困惑在win 11.2.0.4中打扩展patch的之后,oracle相关无法无法正常启动的问题,今天在朋友的指导下,终于搞定,这里具体描述下这次打patch的相关事宜.
0. win版本信息
20210508121352
1. 关闭oracle相关服务之后,打patch 提示CheckActiveFilesAndExecutables
20210508115852

对于这个问题,可以通过tasklist /M ora*命令找出相关进程,然后杀掉即可
20210508144815
2. 打上psu patch之后,相关服务无法启动
20210508143417
20210508143434
对于这个问题,是由于打上patch之后由于oracle程序调用的需要的MFC动态库不对,需要升级到Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package MFC(https://www.microsoft.com/zh-cn/download/confirmation.aspx?id=26347)
20210508121006
启动相关服务正常
20210508144417
安装相关patch成功
20210508121147
发表在 Oracle安装升级 | 标签为 | 评论关闭

Avaddon勒索病毒数据库恢复

发表于 2021 年 5 月 5 日 由 惜分飞

接到朋友一个oracle数据库被加密的恢复请求，被加密文件为：
20210505193114

read.txt文件中信息

-------===    Your network has been infected!    ===-------





*****************DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED*****************





All your documents, photos, databases and other important 

files have been encrypted and have the extension: .BCdadccBEA



You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files!



The only way to restore your files is to buy our special software. 
Only we can give you this software and only we can restore your files!



We have also downloaded a lot of private data from your network.

If you do not contact as in a 3 days we will post information about your breach 
on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info.



You can get more information on our page, which is located in a Tor hidden network.





How to get to our page

--------------------------------------------------------------------------------

|

|  1. Download Tor browser - https://www.torproject.org/

|

|  2. Install Tor browser

|

|  3. Open link in Tor browser - avaddonbotrxmuyl.onion

|

|  4. Follow the instructions on this page

|

--------------------------------------------------------------------------------



Your ID:

--------------------------------------------------------------------------------



MjQ4Ni1VeE5hL2hSVzJVeXU0Wm1CeHhhdDFLUDVGWTlqMnJFekZlczd3NlVFdnBROHYz…………



--------------------------------------------------------------------------------



* DO NOT TRY TO RECOVER FILES YOURSELF!



* DO NOT MODIFY ENCRYPTED FILES!



* * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * *

YHSKC2aqLa0A1xzn

通过底层分析坏块情况,确认只是对文件头的127个block进行了破坏
20210505192823
由于客户是10g的版本,无法实现直接open库,然后expdp/exp导出数据.通过底层技术,直接恢复数据到新库,然后处理非表数据(index,view,proc,sequence等),实现最大限度恢复客户数据,最大程度减少客户整合数据的工作量
20210505194153

如果此类的数据库文件(oracle,mysql,sql server)等被加密,需要专业恢复技术支持，请联系我们:
电话/微信:17813235971    Q Q:107644445QQ咨询惜分飞    E-Mail:dba@xifenfei.com

发表在 勒索恢复 | 标签为 , , , | 评论关闭