Oracle 极端恢复支持

所有类似dul工具(包括原厂和三方工具)可以完成的Oracle数据库恢复工作,我们均可通过服务提供恢复支持,而且是恢复数据成功之后收费,恢复不成功不收费

  • 不需要运行Oracle数据库软件,直接读取数据库文件解析数据。
  • 支持ASM,能够直接从ASM磁盘中导出数据,即使相关的磁盘组不能成功mount
  • 支持从ASM中直接抽取出数据文件和其他任意存储在ASM中的文件(包括控制文件、日志文件和归档日志等),即使相关的磁盘组不能成功mount
  • 在ASM磁盘损坏严重的情况下,可以扫描ASM磁盘,提取出没有被覆盖的数据文件,然后再提取和恢复数据。
  • 支持的Oracle数据库版本包括7,8i,9i,10g,11g,12c,18c,19c
  • 支持多种平台的数据库,包括AIX、LINUX、HPUX、SOLARIS、WINDOWS等。能够在一个平台上导出其他平台的数据,比如在Windows 32位系统上,使用AIX系统上的数据文件导出数据。
  • 支持的数据类型包括:NUMBER, CHAR, VARCHAR2, NCHAR,NVARHCAR2, LONG, DATE, RAW, LONG RAW, BLOB, CLOB, TIMESTAMP (9i+) , BINARY FLOAT, BINARY DOUBLE (10g+),XMLTYPE
  • 全面支持LOB字段:
    • 支持CLOB、NCLOB和BLOB
    • CLOB支持Big Endian和Little Endian字节序
    • 支持LOB分区,子分区
    • 支持同一个表中,不同LOB列使用不同CHUNK SIZE的情况
    • CLOB数据可以导出到与其他列相同的文件中,或存储到单独的文件
    • LOB列在没有SYSTEM表空间的情况下仍然能够导出
    • LOB列在相关的lob index损坏的情况下依然能够导出
    • 能够恢复Oracle 11g及以上版本的SecureFile LOB(目前不支持去重和加密的SecureFile LOB)
  • 支持各种表,包括普通的HEAP表,IOT表和聚簇(CLUSTER)表
  • 支持IOT表:
    • 支持普通IOT表的导出
    • 支持压缩IOT表的导出
    • 支持IOT表溢出段
    • 支持IOT表分区(包括子分区)
    • 只能在有SYSTEM表空间时才能导出IOT表
  • 支持压缩表
  • 支持表被truncate后的数据恢复
  • 支持表被drop后的数据恢复
  • 在有SYSTEM表空间的情况下,自动获取数据字典信息
  • 支持在没有SYSTEM表空间和数据字典损坏的情况下恢复数据,在没有数据字典可用时,能够自动判断数据的类型
  • 支持10g及以上的大文件(BigFile)表空间
  • 全面支持64位系统,支持超过4G大小的数据文件。
  • 支持复制操作系统命令不能复制的坏文件
  • 支持同一个库中不同块大小的数据文件。
  • 支持多种字符集之间的转换,能够正确的转换CLOB、NCLOB、NVARCHAR2列类型的数据到指定的字符集。
  • 自动检测数据文件的表空间号和文件号
  • 导出的数据格式包括纯文本、exp dmp和expdp dmp文件三种。以纯文本导出时,能够自动生成建表的SQL语句和SQL*Loader导入所需的control文件
  • 模拟Oracle的dump块功能,能够dump数据文件中的数据块
  • 支持DESC表,以显示表的列定义
  • 支持列出表的分区和子分区
  • 支持对误删除数据的恢复,即使被删除数据的表中有LOB列,即使被删除数据的表中对应row directory中所有记录的offset都已经完全被Oracle清除
  • 支持表创建语句,存储过程,视图,函数,包,索引,约束等非数据恢复

Globeimposter*865qqz勒索病毒恢复

最近有客户服务器文件被加密其后缀名为:.Globeimposter-Beta865qqz,通过往上分析,起相关的后缀名有类似的:
.Globeimposter-Alpha865qqz
.Globeimposter-Beta865qqz
.Globeimposter-Delta865qqz
.Globeimposter-Epsilon865qqz
.Globeimposter-Gamma865qqz
.Globeimposter-Zeta865qqz,类似截图如下:
20200207191431


通过分析发现数据被加密破坏
20200207192144


经过对其文件的底层处理,实现绝大部分数据恢复
20200207192721


经过分析,我们可以对此类病毒的部分数据库(oracle dmp,sql bak等)进行恢复,如果有此类问题,可以联系我们进行恢复支持

mysql ibd文件恢复

在mysql中由于某种原因保存有ibd文件,但是表已经被删除或者frm文件损坏亦或者ibdata文件损坏/丢失等。本文模拟在这种情况下,通过mysql自身技术即可完成ibd文件恢复.
测试环境mysql版本

mysql> select version();
+-----------+
| version() |
+-----------+
| 5.6.25    |
+-----------+
1 row in set (0.00 sec)

mysql主要参数

mysql> show variables like 'innodb_file_per_table';
+-----------------------+-------+
| Variable_name         | Value |
+-----------------------+-------+
| innodb_file_per_table | ON    |
+-----------------------+-------+
1 row in set (0.00 sec)
mysql> show variables like 'innodb_force_recovery';
+-----------------------+-------+
| Variable_name         | Value |
+-----------------------+-------+
| innodb_force_recovery | 0     |
+-----------------------+-------+
1 row in set (0.00 sec)

innodb_file_per_table这个参数为on才能够实现每个表存储单独的ibd文件.innodb_force_recovery参数默认范围0

测试表情况

mysql> use xifenfei;
Database changed
mysql> show tables;
+-----------------------------+
| Tables_in_xifenfei          |
+-----------------------------+
| user_login                  |
+-----------------------------+
1 rows in set (0.00 sec)

mysql> select count(*) from user_login;
+----------+
| count(*) |
+----------+
|       48 |
+----------+
1 row in set (0.02 sec)

mysql> desc user_login;
+------------+--------------+------+-----+---------+-------+
| Field      | Type         | Null | Key | Default | Extra |
+------------+--------------+------+-----+---------+-------+
| ID         | varchar(255) | NO   | PRI | NULL    |       |
| ACCOUNT    | varchar(255) | YES  |     | NULL    |       |
| LifeCycle  | int(11)      | YES  |     | NULL    |       |
| Name       | varchar(255) | YES  |     | NULL    |       |
| Password   | varchar(255) | YES  |     | NULL    |       |
| Role       | varchar(255) | YES  |     | NULL    |       |
| UTime      | varchar(255) | YES  |     | NULL    |       |
| UserID     | varchar(255) | YES  |     | NULL    |       |
| UserName   | varchar(255) | YES  |     | NULL    |       |
| UserStatus | int(11)      | YES  |     | NULL    |       |
+------------+--------------+------+-----+---------+-------+
10 rows in set (0.05 sec)

mysql> select * from user_login limit 1;
+----------------------------------+---------+-----------+-----------+----------
------------------------+------+---------------------+--------------------------
--------+----------+------------+
| ID                               | ACCOUNT | LifeCycle | Name      | Password
                        | Role | UTime               | UserID
        | UserName | UserStatus |
+----------------------------------+---------+-----------+-----------+----------
------------------------+------+---------------------+--------------------------
--------+----------+------------+
| 010d6c85a76c44cba80d07cbd8590bb2 | hyh     |         0 | 胡元会    | 698d51a19
d8a121ce581499d7b701668 | |6|  | 2016-08-30 06:04:32 | 0fe3bc4dd9654687a4b85065e
d5cfee8 | NULL     |          1 |
+----------------------------------+---------+-----------+-----------+----------
------------------------+------+---------------------+--------------------------
--------+----------+------------+
1 row in set (0.00 sec)

mysql> show create table user_login \G;
*************************** 1. row *************
       Table: user_login
Create Table: CREATE TABLE `user_login` (
  `ID` varchar(255) NOT NULL,
  `ACCOUNT` varchar(255) DEFAULT NULL,
  `LifeCycle` int(11) DEFAULT NULL,
  `Name` varchar(255) DEFAULT NULL,
  `Password` varchar(255) DEFAULT NULL,
  `Role` varchar(255) DEFAULT NULL,
  `UTime` varchar(255) DEFAULT NULL,
  `UserID` varchar(255) DEFAULT NULL,
  `UserName` varchar(255) DEFAULT NULL,
  `UserStatus` int(11) DEFAULT NULL,
  PRIMARY KEY (`ID`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8
1 row in set (0.00 sec)


mysql> show variables like 'datadir';
+---------------+-----------------------------------------------+
| Variable_name | Value                                         |
+---------------+-----------------------------------------------+
| datadir       | D:\xifenfei\mysql-5.6.25-winx64\data\ |
+---------------+-----------------------------------------------+
1 row in set (0.00 sec)

备份ibd文件

C:\Users\XIFENFEI>dir D:\xifenfei\mysql-5.6.25-winx64\data\xifenfei\user_login.ibd
 驱动器 D 中的卷没有标签。
 卷的序列号是 4215-1F18

 D:\xifenfei\mysql-5.6.25-winx64\data\xifenfei 的目录

2016-12-02  20:07            98,304 user_login.ibd
               1 个文件         98,304 字节
               0 个目录 78,789,591,040 可用字节
C:\Users\XIFENFEI>cp D:\xifenfei\mysql-5.6.25-winx64\data\xifenfei\user_login.ibd d:/
C:\Users\XIFENFEI>dir d:\user_login.ibd
 驱动器 D 中的卷没有标签。
 卷的序列号是 4215-1F18

 d:\ 的目录

2016-12-25  23:15            98,304 user_login.ibd
               1 个文件         98,304 字节
               0 个目录 78,789,591,040 可用字节

模拟删除表(ibd文件也被删除)

mysql> drop table xifenfei.user_login;
Query OK, 0 rows affected (0.03 sec)


C:\Users\XIFENFEI>dir D:\xifenfei\mysql-5.6.25-winx64\data\xifenfei\user_login.ibd
 驱动器 D 中的卷没有标签。
 卷的序列号是 4215-1F18

 D:\xifenfei\mysql-5.6.25-winx64\data\xifenfei 的目录

找不到文件

创建新表

mysql> CREATE TABLE `user_login` (
    ->   `ID` varchar(255) NOT NULL,
    ->   `ACCOUNT` varchar(255) DEFAULT NULL,
    ->   `LifeCycle` int(11) DEFAULT NULL,
    ->   `Name` varchar(255) DEFAULT NULL,
    ->   `Password` varchar(255) DEFAULT NULL,
    ->   `Role` varchar(255) DEFAULT NULL,
    ->   `UTime` varchar(255) DEFAULT NULL,
    ->   `UserID` varchar(255) DEFAULT NULL,
    ->   `UserName` varchar(255) DEFAULT NULL,
    ->   `UserStatus` int(11) DEFAULT NULL,
    ->   PRIMARY KEY (`ID`)
    -> ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
Query OK, 0 rows affected (0.03 sec)

C:\Users\XIFENFEI>dir D:\xifenfei\mysql-5.6.25-winx64\data\xifenfei\user_login.ibd
 驱动器 D 中的卷没有标签。
 卷的序列号是 4215-1F18

 D:\xifenfei\mysql-5.6.25-winx64\data\xifenfei 的目录

2016-12-25  23:19            98,304 user_login.ibd
               1 个文件         98,304 字节
               0 个目录 78,789,591,040 可用字节

mysql> select count(*) from xifenfei.user_login;
+----------+
| count(*) |
+----------+
|        0 |
+----------+
1 row in set (0.00 sec)

停掉mysql,替换user_login.ibd

C:\Users\XIFENFEI>dir D:\xifenfei\mysql-5.6.25-winx64\data\xifenfei\user_login.ibd
 驱动器 D 中的卷没有标签。
 卷的序列号是 4215-1F18

 D:\xifenfei\mysql-5.6.25-winx64\data\xifenfei 的目录

2016-12-25  23:22            98,304 user_login.ibd
               1 个文件         98,304 字节
               0 个目录 78,787,141,632 可用字节

C:\Users\XIFENFEI>cp d:\user_login.ibd D:\xifenfei\mysql-5.6.25-winx64\data\xifenfei\user_login.ibd
C:\Users\XIFENFEI>dir D:\xifenfei\mysql-5.6.25-winx64\data\xifenfei\user_login.ibd
 驱动器 D 中的卷没有标签。
 卷的序列号是 4215-1F18

 D:\xifenfei\mysql-5.6.25-winx64\data\xifenfei 的目录

2016-12-02  20:07            98,304 user_login.ibd
               1 个文件         98,304 字节
               0 个目录 78,787,141,632 可用字节

启动mysql 服务,查询数据库

mysql> select count(*) from xifenfei.user_login;
ERROR 2013 (HY000): Lost connection to MySQL server during query
mysql> exit
Bye

C:\Users\XIFENFEI>mysql -uroot
ERROR 2003 (HY000): Can't connect to MySQL server on 'localhost' (10061)

mysql 日志报错

2016-12-25 23:31:07 11632 [Note] MySQL: ready for connections.
Version: '5.6.25'  socket: ''  port: 3306  MySQL Community Server (GPL)
InnoDB: Error: tablespace id is 56 in the data dictionary
InnoDB: but in file .\xifenfei\user_login.ibd it is 47!
2016-12-25 23:31:31 2eb8  InnoDB: Assertion failure in thread 11960 in file fil0fil.cc line 796
InnoDB: We intentionally generate a memory trap.
InnoDB: Submit a detailed bug report to http://bugs.mysql.com.
InnoDB: If you get repeated assertion failures or crashes, even
InnoDB: immediately after the mysqld startup, there may be

很明显由于替换的ibd文件和现在数据库记录的ibd文件的page的字典信息不匹配,因为数据库无法正常查询该数据,而且mysql为了安全直接把实例给crash了.

恢复操作

mysql> show variables like 'innodb_force_recovery';
+-----------------------+-------+
| Variable_name         | Value |
+-----------------------+-------+
| innodb_force_recovery | 1     |
+-----------------------+-------+
1 row in set (0.00 sec)
mysql> alter table xifenfei.user_login discard tablespace;
Query OK, 0 rows affected, 2 warnings (0.02 sec)

mysql> alter table xifenfei.user_login import tablespace;
Query OK, 0 rows affected, 1 warning (0.06 sec)

mysql> select count(*) from xifenfei.user_login;
+----------+
| count(*) |
+----------+
|       48 |
+----------+
1 row in set (0.00 sec)

mysql> select * from xifenfei.user_login limit 1;
+----------------------------------+---------+-----------+-----------+----------
------------------------+------+---------------------+--------------------------
--------+----------+------------+
| ID                               | ACCOUNT | LifeCycle | Name      | Password
                        | Role | UTime               | UserID
        | UserName | UserStatus |
+----------------------------------+---------+-----------+-----------+----------
------------------------+------+---------------------+--------------------------
--------+----------+------------+
| 010d6c85a76c44cba80d07cbd8590bb2 | hyh     |         0 | 胡元会    | 698d51a19
d8a121ce581499d7b701668 | |6|  | 2016-08-30 06:04:32 | 0fe3bc4dd9654687a4b85065e
d5cfee8 | NULL     |          1 |
+----------------------------------+---------+-----------+-----------+----------
------------------------+------+---------------------+--------------------------
--------+----------+------------+
1 row in set (0.00 sec)

通过mysql自带的discard tablespace和import tablespace操作后,表数据已经可以完成查询了.
mysql日志

2016-12-25 23:34:08 10464 [ERROR] InnoDB: Failed to find tablespace for table '"xifenfei"."user_login"' in the cache. Attempting to load the tablespace with space id 56.
2016-12-25 23:34:08 10464 [ERROR] InnoDB: In file '.\xifenfei\user_login.ibd', tablespace id and flags are 47 and 0, but in the InnoDB data dictionary they are 56 and 0. Have you moved InnoDB .ibd files around without using the commands DISCARD TABLESPACE and IMPORT TABLESPACE? Please refer to http://dev.mysql.com/doc/refman/5.6/en/innodb-troubleshooting-datadict.html for how to resolve the issue.
2016-12-25 23:34:08 10464 [ERROR] InnoDB: Could not find a valid tablespace file for 'xifenfei/user_login'. See http://dev.mysql.com/doc/refman/5.6/en/innodb-troubleshooting-datadict.html for how to resolve the issue.
2016-12-25 23:34:08 30e8 InnoDB: cannot calculate statistics for table "xifenfei"."user_login" because the .ibd file is missing. For help, please refer to http://dev.mysql.com/doc/refman/5.6/en/innodb-troubleshooting.html
2016-12-25 23:34:08 10464 [ERROR] InnoDB: Cannot delete tablespace 56 because it is not found in the tablespace memory cache.
2016-12-25 23:34:08 10464 [Warning] InnoDB: Cannot delete tablespace 56 in DISCARD TABLESPACE. Tablespace not found
2016-12-25 23:34:41 10464 [Note] InnoDB: Sync to disk
2016-12-25 23:34:41 10464 [Note] InnoDB: Sync to disk - done!
2016-12-25 23:34:41 10464 [Note] InnoDB: Phase I - Update all pages
2016-12-25 23:34:41 10464 [Note] InnoDB: Sync to disk
2016-12-25 23:34:41 10464 [Note] InnoDB: Sync to disk - done!
2016-12-25 23:34:41 10464 [Warning] InnoDB: Tablespace 'xifenfei/user_login' exists in the cache with id 47 != 56
2016-12-25 23:34:41 10464 [Warning] InnoDB: Freeing existing tablespace 'xifenfei/user_login' entry from the cache with id 56
2016-12-25 23:34:41 10464 [Note] InnoDB: Phase III - Flush changes to disk
2016-12-25 23:34:41 10464 [Note] InnoDB: Phase IV - Flush complete

mysql日志依旧报了page字典信息不匹配.但是数据已经可以访问,通过mysqldump导出重新创建表即可.如果由于ibd损坏使用该方法无法恢复,请参考:MySQL drop database恢复(恢复方法同样适用MySQL drop table,delete,truncate table)

mysql delete 数据恢复

在mysql(innodb引擎)中,有些时候犹豫误操作导致表中数据被删除,从而导致不可挽回的损失,本文模拟在数据库被误delete的情况下,实现较为完美删除,当然在实际中可能有少量不覆盖或者无法恢复回来,但是在覆盖不多或者未覆盖的情况下,可以实现绝大多数甚至全部恢复.因此在发生误操作时候,应当第一时间保护现场,尽可能防止复写导致不可挽回的损失.在测试恢复过程中,由于mysql和操作系统编码问题,折腾了很久,感谢Lunar的指点
创建模拟表并插入数据

mysql> CREATE TABLE `sms_send_record_del` (
    ->   `messageId` varchar(30) NOT NULL,
    ->   `tokenId` varchar(20) NOT NULL,
    ->   `mobile` varchar(14) default NULL,
    ->   `msgFormat` int(1) NOT NULL,
    ->   `msgContent` varchar(1000) default NULL,
    ->   `scheduleDate` timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
    ->   `deliverState` int(1) default NULL,
    ->   `deliverdTime` timestamp NOT NULL default '0000-00-00 00:00:00',
    ->   PRIMARY KEY  (`messageId`)
    -> ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
Query OK, 0 rows affected (0.00 sec)

mysql> insert into sms_send_record_del select * from sms_send_record;
Query OK, 11 rows affected (0.00 sec)
Records: 11  Duplicates: 0  Warnings: 0

mysql> checksum table sms_send_record_del;
+---------------------------------+------------+
| Table                           | Checksum   |
+---------------------------------+------------+
| sms_service.sms_send_record_del | 2258631583 | 
+---------------------------------+------------+
1 row in set (0.00 sec)

mysql> checksum table sms_send_record;    
+-----------------------------+------------+
| Table                       | Checksum   |
+-----------------------------+------------+
| sms_service.sms_send_record | 2258631583 | 
+-----------------------------+------------+
1 row in set (0.00 sec)

mysql-delete-recovery-1


确定innodb文件对应位置

mysql> SHOW VARIABLES LIKE 'datadir';
+---------------+-----------------+
| Variable_name | Value           |
+---------------+-----------------+
| datadir       | /var/lib/mysql/ | 
+---------------+-----------------+
1 row in set (0.00 sec)

mysql> SHOW VARIABLES LIKE 'innodb_file_per_table';
+-----------------------+-------+
| Variable_name         | Value |
+-----------------------+-------+
| innodb_file_per_table | OFF   | 
+-----------------------+-------+
1 row in set (0.00 sec)

mysql> SHOW VARIABLES LIKE 'innodb_data_file_path';
+-----------------------+------------------------+
| Variable_name         | Value                  |
+-----------------------+------------------------+
| innodb_data_file_path | ibdata1:10M:autoextend | 
+-----------------------+------------------------+
1 row in set (0.00 sec)

删除表记录
模拟错误操作,误删除表所有数据

mysql> delete from sms_send_record_del;
Query OK, 11 rows affected (0.00 sec)

解析ibdata1文件

[root@web103 mysql_recovery]# ./stream_parser -f /var/lib/mysql/ibdata1 
Opening file: /var/lib/mysql/ibdata1
File information:

ID of device containing file:         2049
inode number:                      1344553
protection:                         100660 (regular file)
number of hard links:                    1
user ID of owner:                       27
group ID of owner:                      27
device ID (if special file):             0
blocksize for filesystem I/O:         4096
number of blocks allocated:         315712
time of last access:            1440599559 Wed Aug 26 22:32:39 2015
time of last modification:      1440601853 Wed Aug 26 23:10:53 2015
time of last status change:     1440601853 Wed Aug 26 23:10:53 2015
total size, in bytes:            161480704 (154.000 MiB)

Size to process:                 161480704 (154.000 MiB)
Opening file: /var/lib/mysql/ibdata1
File information:

ID of device containing file:         2049
inode number:                      1344553
protection:                         100660 (regular file)
number of hard links:                    1
user ID of owner:                       27
group ID of owner:                      27
device ID (if special file):             0
blocksize for filesystem I/O:         4096
number of blocks allocated:         315712
time of last access:            1440599559 Wed Aug 26 22:32:39 2015
time of last modification:      1440601853 Wed Aug 26 23:10:53 2015
time of last status change:     1440601853 Wed Aug 26 23:10:53 2015
total size, in bytes:            161480704 (154.000 MiB)

Size to process:                 161480704 (154.000 MiB)
Opening file: /var/lib/mysql/ibdata1
File information:

ID of device containing file:         2049
inode number:                      1344553
protection:                         100660 (regular file)
number of hard links:                    1
user ID of owner:                       27
group ID of owner:                      27
device ID (if special file):             0
blocksize for filesystem I/O:         4096
number of blocks allocated:         315712
time of last access:            1440599559 Wed Aug 26 22:32:39 2015
time of last modification:      1440601853 Wed Aug 26 23:10:53 2015
time of last status change:     1440601853 Wed Aug 26 23:10:53 2015
total size, in bytes:            161480704 (154.000 MiB)

Size to process:                 161480704 (154.000 MiB)
Opening file: /var/lib/mysql/ibdata1
File information:

ID of device containing file:         2049
inode number:                      1344553
protection:                         100660 (regular file)
number of hard links:                    1
user ID of owner:                       27
group ID of owner:                      27
device ID (if special file):             0
blocksize for filesystem I/O:         4096
number of blocks allocated:         315712
time of last access:            1440599559 Wed Aug 26 22:32:39 2015
time of last modification:      1440601853 Wed Aug 26 23:10:53 2015
time of last status change:     1440601853 Wed Aug 26 23:10:53 2015
total size, in bytes:            161480704 (154.000 MiB)

Size to process:                 161480704 (154.000 MiB)
Opening file: /var/lib/mysql/ibdata1
File information:

ID of device containing file:         2049
inode number:                      1344553
protection:                         100660 (regular file)
number of hard links:                    1
user ID of owner:                       27
group ID of owner:                      27
device ID (if special file):             0
blocksize for filesystem I/O:         4096
number of blocks allocated:         315712
Opening file: /var/lib/mysql/ibdata1
time of last access:            1440599559 Wed Aug 26 22:32:39 2015
time of last modification:      1440601853 Wed Aug 26 23:10:53 2015
time of last status change:     1440601853 Wed Aug 26 23:10:53 2015
File information:

total size, in bytes:            161480704 (154.000 MiB)

ID of device containing file:         2049
Size to process:                 161480704 (154.000 MiB)
Opening file: /var/lib/mysql/ibdata1
File information:

ID of device containing file:         2049
inode number:                      1344553
protection:                         100660 (regular file)
number of hard links:                    1
user ID of owner:                       27
group ID of owner:                      27
device ID (if special file):             0
blocksize for filesystem I/O:         4096
number of blocks allocated:         315712
time of last access:            1440599559 Wed Aug 26 22:32:39 2015
time of last modification:      1440601853 Wed Aug 26 23:10:53 2015
time of last status change:     1440601853 Wed Aug 26 23:10:53 2015
total size, in bytes:            161480704 (154.000 MiB)

Size to process:                 161480704 (154.000 MiB)
Opening file: /var/lib/mysql/ibdata1
inode number:                      1344553
protection:                         100660 (regular file)
number of hard links:                    1
user ID of owner:                       27
group ID of owner:                      27
device ID (if special file):             0
File information:

blocksize for filesystem I/O:         4096
number of blocks allocated:         315712
ID of device containing file:         2049
inode number:                      1344553
protection:                         100660 (regular file)
number of hard links:                    1
user ID of owner:                       27
group ID of owner:                      27
device ID (if special file):             0
blocksize for filesystem I/O:         4096
number of blocks allocated:         315712
time of last access:            1440599559 Wed Aug 26 22:32:39 2015
time of last modification:      1440601853 Wed Aug 26 23:10:53 2015
time of last status change:     1440601853 Wed Aug 26 23:10:53 2015
total size, in bytes:            161480704 (154.000 MiB)

Size to process:                 161480704 (154.000 MiB)
time of last access:            1440601884 Wed Aug 26 23:11:24 2015
time of last modification:      1440601853 Wed Aug 26 23:10:53 2015
time of last status change:     1440601853 Wed Aug 26 23:10:53 2015
total size, in bytes:            161480704 (154.000 MiB)

Size to process:                 161480704 (154.000 MiB)
All workers finished in 0 sec

分析数据字典

mysql> show tables
    -> ;
+----------------+
| Tables_in_test |
+----------------+
| SYS_COLUMNS    | 
| SYS_FIELDS     | 
| SYS_INDEXES    | 
| SYS_TABLES     | 
+----------------+
4 rows in set (0.00 sec)

mysql> select * from SYS_TABLES;
+----------------------------------------+----+-------------+------+--------+---------+--------------+-------+
| NAME                                   | ID | N_COLS      | TYPE | MIX_ID | MIX_LEN | CLUSTER_NAME | SPACE |
+----------------------------------------+----+-------------+------+--------+---------+--------------+-------+
| recover/t_delete                       | 74 |           2 |    1 |      0 |       0 |              |     0 | 
| recover/t_delete1                      | 84 |           2 |    1 |      0 |       0 |              |     0 | 
| recover/t_xifenfei                     | 75 |           2 |    1 |      0 |       0 |              |     0 | 
| recover/zx_users                       | 89 |          85 |    1 |      0 |       0 |              |     0 | 
| sms_service/sms_send_record            | 36 |           8 |    1 |      0 |       0 |              |     0 | 
| sms_service/sms_send_record_del        | 90 |           8 |    1 |      0 |       0 |              |     0 | 
| SYS_FOREIGN                            | 11 | -2147483644 |    1 |      0 |       0 |              |     0 | 
| SYS_FOREIGN_COLS                       | 12 | -2147483644 |    1 |      0 |       0 |              |     0 | 
| test/SYS_COLUMNS                       | 86 |           7 |    1 |      0 |       0 |              |     0 | 
| test/SYS_FIELDS                        | 88 |           3 |    1 |      0 |       0 |              |     0 | 
| test/SYS_INDEXES                       | 87 |           7 |    1 |      0 |       0 |              |     0 | 
| test/SYS_TABLES                        | 85 |           8 |    1 |      0 |       0 |              |     0 | 
| test/zx_users                          | 43 |          85 |    1 |      0 |       0 |              |     0 | 
| xifenfei/t_delete                      | 44 |           8 |    1 |      0 |       0 |              |     0 | 
| xifenfei/t_xifenfei                    | 59 |           2 |    1 |      0 |       0 |              |     0 | 
+----------------------------------------+----+-------------+------+--------+---------+--------------+-------+
39 rows in set (0.00 sec)

mysql> select * from SYS_INDEXES WHERE TABLE_ID=90;
+----------+-----+---------+----------+------+-------+---------+
| TABLE_ID | ID  | NAME    | N_FIELDS | TYPE | SPACE | PAGE_NO |
+----------+-----+---------+----------+------+-------+---------+
|       90 | 110 | PRIMARY |        1 |    3 |     0 |    2955 | 
+----------+-----+---------+----------+------+-------+---------+
1 row in set (0.00 sec)

找回被删除记录

[root@web103 mysql_recovery]# ./c_parser -5Df pages-ibdata1/FIL_PAGE_INDEX/0000000000000110.page \
[root@web103 mysql_recovery]#    -t dictionary/sms_send_record_del.sql >/tmp/t_1.txt 2>/tmp/t_1.sql

mysql-delete-recovery-2


加载数据并验证

mysql> use sms_service;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> source /tmp/t_1.sql
Query OK, 0 rows affected (0.00 sec)

Query OK, 11 rows affected, 8 warnings (0.01 sec)
Records: 11  Deleted: 0  Skipped: 0  Warnings: 8

mysql> checksum table sms_send_record_del;
+---------------------------------+------------+
| Table                           | Checksum   |
+---------------------------------+------------+
| sms_service.sms_send_record_del | 2258631583 | 
+---------------------------------+------------+
1 row in set (0.00 sec)

发生误操作之时,请尽可能保护现场,防止覆盖导致无可挽回的损失.

MySQL drop database恢复

昨天晚上接到一个网络服务请求,由于不小心点击了自己产品软件上面的清空数据功能(这个工具确实需要小心,在Oracle恢复案例中,也有xx企业erp该功能导致数据被删除请求恢复),导致MySQL数据库被直接drop database掉了,之前没有做任何备份,只是发生故障之后,他们立即封存现场,备份出来了ibdata1文件。接到请求之后,通过让其把ibdata1文件发给过来,通过MySQL recovery工具进行分析恢复,经过6个小时的处理,基本上实现核心数据0丢失.
解析ibdata1(innodb文件)

[root@localhost recovery_MySQL]# ./stream_parser -f /tmp/ibdata1
Opening file: /tmp/ibdata1
File information:

ID of device containing file:         2055
inode number:                        97257
protection:                         100644 (regular file)
number of hard links:                    1
user ID of owner:                        0
group ID of owner:                       0
device ID (if special file):             0
blocksize for filesystem I/O:         4096
number of blocks allocated:          36920
Opening file: /tmp/ibdata1
time of last access:            1440083236 Thu Aug 20 23:07:16 2015
File information:

time of last modification:      1440062236 Thu Aug 20 17:17:16 2015
time of last status change:     1440081904 Thu Aug 20 22:45:04 2015
ID of device containing file:         2055
inode number:                        97257
protection:                         100644 total size, in bytes:             18874368 (18.000 MiB)

(regular file)
number of hard links:                    1
user ID of owner:                        0
group ID of owner:                       0
device ID (if special file):             0
blocksize for filesystem I/O:         4096
number of blocks allocated:          36920
Size to process:                  18874368 (18.000 MiB)
Opening file: /tmp/ibdata1
File information:

ID of device containing file:         2055
inode number:                        97257
protection:                         100644 (regular file)
number of hard links:                    1
user ID of owner:                        0
group ID of owner:                       0
device ID (if special file):             0
blocksize for filesystem I/O:         4096
number of blocks allocated:          36920
time of last access:            1440083236 Thu Aug 20 23:07:16 2015
time of last modification:      1440062236 Thu Aug 20 17:17:16 2015
time of last status change:     1440081904 Thu Aug 20 22:45:04 2015
total size, in bytes:             18874368 (18.000 MiB)

Opening file: /tmp/ibdata1
File information:

Size to process:                  18874368 (18.000 MiB)
ID of device containing file:         2055
inode number:                        97257
protection:                         100644 (regular file)
time of last access:            1440083236 Thu Aug 20 23:07:16 2015
number of hard links:                    1
user ID of owner:                        0
time of last modification:      1440062236 Thu Aug 20 17:17:16 2015
group ID of owner:                       0
time of last status change:     1440081904 Thu Aug 20 22:45:04 2015
device ID (if special file):             0
blocksize for filesystem I/O:         4096
number of blocks allocated:          36920
total size, in bytes:             18874368 (18.000 MiB)

Size to process:                  18874368 (18.000 MiB)
Opening file: /tmp/ibdata1
File information:

ID of device containing file:         2055
inode number:                        97257
protection:                         100644 (regular file)
number of hard links:                    1
user ID of owner:                        0
time of last access:            1440083236 Thu Aug 20 23:07:16 2015
group ID of owner:                       0
device ID (if special file):             0
time of last modification:      1440062236 Thu Aug 20 17:17:16 2015
blocksize for filesystem I/O:         4096
time of last status change:     1440081904 Thu Aug 20 22:45:04 2015
number of blocks allocated:          36920
Opening file: /tmp/ibdata1
total size, in bytes:             18874368 (18.000 MiB)

File information:

Size to process:                  18874368 (18.000 MiB)
ID of device containing file:         2055
inode number:                        97257
protection:                         100644 (regular file)
number of hard links:                    1
user ID of owner:                        0
group ID of owner:                       0
device ID (if special file):             0
time of last access:            1440083236 Thu Aug 20 23:07:16 2015
blocksize for filesystem I/O:         4096
time of last modification:      1440062236 Thu Aug 20 17:17:16 2015
number of blocks allocated:          36920
time of last status change:     1440081904 Thu Aug 20 22:45:04 2015
Opening file: /tmp/ibdata1
total size, in bytes:             18874368 (18.000 MiB)

File information:

Size to process:                  18874368 (18.000 MiB)
ID of device containing file:         2055
inode number:                        97257
protection:                         100644 (regular file)
number of hard links:                    1
user ID of owner:                        0
group ID of owner:                       0
device ID (if special file):             0
blocksize for filesystem I/O:         4096
number of blocks allocated:          36920
time of last access:            1440083236 Thu Aug 20 23:07:16 2015
time of last modification:      1440062236 Thu Aug 20 17:17:16 2015
time of last status change:     1440081904 Thu Aug 20 22:45:04 2015
Opening file: /tmp/ibdata1
File information:

total size, in bytes:             18874368 (18.000 MiB)

ID of device containing file:         2055
inode number:                        97257
protection:                         100644 Size to process:                  18874368 (18.000 MiB)
(regular file)
number of hard links:                    1
time of last access:            1440083236 Thu Aug 20 23:07:16 2015
user ID of owner:                        0
group ID of owner:                       0
time of last modification:      1440062236 Thu Aug 20 17:17:16 2015
Opening file: /tmp/ibdata1
time of last status change:     1440081904 Thu Aug 20 22:45:04 2015
device ID (if special file):             0
File information:

blocksize for filesystem I/O:         4096
number of blocks allocated:          36920
total size, in bytes:             18874368 (18.000 MiB)

ID of device containing file:         2055
inode number:                        97257
protection:                         100644 (regular file)
Size to process:                  18874368 (18.000 MiB)
number of hard links:                    1
user ID of owner:                        0
group ID of owner:                       0
device ID (if special file):             0
blocksize for filesystem I/O:         4096
number of blocks allocated:          36920
time of last access:            1440083236 Thu Aug 20 23:07:16 2015
Opening file: /tmp/ibdata1
time of last modification:      1440062236 Thu Aug 20 17:17:16 2015
File information:

time of last status change:     1440081904 Thu Aug 20 22:45:04 2015
ID of device containing file:         2055
total size, in bytes:             18874368 (18.000 MiB)

inode number:                        97257
protection:                         100644 (regular file)
number of hard links:                    1
user ID of owner:                        0
Size to process:                  18874368 (18.000 MiB)
group ID of owner:                       0
time of last access:            1440083236 Thu Aug 20 23:07:16 2015
device ID (if special file):             0
blocksize for filesystem I/O:         4096
time of last modification:      1440062236 Thu Aug 20 17:17:16 2015
number of blocks allocated:          36920
time of last status change:     1440081904 Thu Aug 20 22:45:04 2015
total size, in bytes:             18874368 (18.000 MiB)

Opening file: /tmp/ibdata1
Size to process:                  18874368 (18.000 MiB)
File information:

ID of device containing file:         2055
inode number:                        97257
protection:                         100644 (regular file)
number of hard links:                    1
time of last access:            1440083236 Thu Aug 20 23:07:16 2015
user ID of owner:                        0
group ID of owner:                       0
time of last modification:      1440062236 Thu Aug 20 17:17:16 2015
device ID (if special file):             0
time of last status change:     1440081904 Thu Aug 20 22:45:04 2015
blocksize for filesystem I/O:         4096
number of blocks allocated:          36920
total size, in bytes:             18874368 (18.000 MiB)

Size to process:                  18874368 (18.000 MiB)
Opening file: /tmp/ibdata1
File information:

ID of device containing file:         2055
inode number:                        97257
protection:                         100644 (regular file)
number of hard links:                    1
user ID of owner:                        0
group ID of owner:                       0
time of last access:            1440083236 Thu Aug 20 23:07:16 2015
device ID (if special file):             0
time of last modification:      1440062236 Thu Aug 20 17:17:16 2015
blocksize for filesystem I/O:         4096
time of last status change:     1440081904 Thu Aug 20 22:45:04 2015
number of blocks allocated:          36920
total size, in bytes:             18874368 (18.000 MiB)

Opening file: /tmp/ibdata1
File information:

Size to process:                  18874368 (18.000 MiB)
ID of device containing file:         2055
inode number:                        97257
protection:                         100644 (regular file)
number of hard links:                    1
user ID of owner:                        0
group ID of owner:                       0
device ID (if special file):             0
blocksize for filesystem I/O:         4096
number of blocks allocated:          36920
time of last access:            1440083236 Thu Aug 20 23:07:16 2015
time of last modification:      1440062236 Thu Aug 20 17:17:16 2015
time of last status change:     1440081904 Thu Aug 20 22:45:04 2015
total size, in bytes:             18874368 (18.000 MiB)

Opening file: /tmp/ibdata1
File information:

Size to process:                  18874368 (18.000 MiB)
ID of device containing file:         2055
inode number:                        97257
time of last access:            1440083236 Thu Aug 20 23:07:16 2015
protection:                         100644 (regular file)
time of last modification:      1440062236 Thu Aug 20 17:17:16 2015
number of hard links:                    1
time of last status change:     1440081904 Thu Aug 20 22:45:04 2015
user ID of owner:                        0
group ID of owner:                       0
device ID (if special file):             0
blocksize for filesystem I/O:         4096
total size, in bytes:             18874368 (18.000 MiB)

number of blocks allocated:          36920
Size to process:                  18874368 (18.000 MiB)
time of last access:            1440083236 Thu Aug 20 23:07:16 2015
time of last modification:      1440062236 Thu Aug 20 17:17:16 2015
time of last status change:     1440081904 Thu Aug 20 22:45:04 2015
total size, in bytes:             18874368 (18.000 MiB)

Size to process:                  18874368 (18.000 MiB)
Opening file: /tmp/ibdata1
File information:

ID of device containing file:         2055
inode number:                        97257
protection:                         100644 (regular file)
number of hard links:                    1
user ID of owner:                        0
group ID of owner:                       0
device ID (if special file):             0
blocksize for filesystem I/O:         4096
number of blocks allocated:          36920
time of last access:            1440083236 Thu Aug 20 23:07:16 2015
time of last modification:      1440062236 Thu Aug 20 17:17:16 2015
time of last status change:     1440081904 Thu Aug 20 22:45:04 2015
total size, in bytes:             18874368 (18.000 MiB)

Size to process:                  18874368 (18.000 MiB)
Opening file: /tmp/ibdata1
File information:

ID of device containing file:         2055
inode number:                        97257
protection:                         100644 (regular file)
number of hard links:                    1
user ID of owner:                        0
group ID of owner:                       0
device ID (if special file):             0
blocksize for filesystem I/O:         4096
number of blocks allocated:          36920
time of last access:            1440083236 Thu Aug 20 23:07:16 2015
time of last modification:      1440062236 Thu Aug 20 17:17:16 2015
time of last status change:     1440081904 Thu Aug 20 22:45:04 2015
total size, in bytes:             18874368 (18.000 MiB)

Size to process:                  18874368 (18.000 MiB)
All workers finished in 0 sec

[root@localhost recovery_MySQL]# cd pages-ibdata1
[root@localhost pages-ibdata1]# ls -l
total 16
drwxr-xr-x 2 root root 4096 Aug 20 22:53 FIL_PAGE_INDEX
drwxr-xr-x 2 root root 4096 Aug 20 22:53 FIL_PAGE_TYPE_BLOB
[root@localhost pages-ibdata1]# cd FIL_PAGE_INDEX
[root@localhost FIL_PAGE_INDEX]# ls -l
total 9924
-rw-r--r-- 1 root root   32768 Aug 20 22:53 0000000000000001.page
-rw-r--r-- 1 root root  278528 Aug 20 22:53 0000000000000002.page
-rw-r--r-- 1 root root   32768 Aug 20 22:53 0000000000000003.page
-rw-r--r-- 1 root root   32768 Aug 20 22:53 0000000000000004.page
-rw-r--r-- 1 root root   32768 Aug 20 22:53 0000000000000005.page
-rw-r--r-- 1 root root   16384 Aug 20 22:53 0000000000000011.page
-rw-r--r-- 1 root root   16384 Aug 20 22:53 0000000000000012.page
-rw-r--r-- 1 root root   16384 Aug 20 22:53 0000000000000013.page
-rw-r--r-- 1 root root   16384 Aug 20 22:53 0000000000000014.page
-rw-r--r-- 1 root root 2883584 Aug 20 22:53 0000000000000065.page
-rw-r--r-- 1 root root  475136 Aug 20 22:53 0000000000000066.page
-rw-r--r-- 1 root root  737280 Aug 20 22:53 0000000000000067.page
-rw-r--r-- 1 root root   49152 Aug 20 22:53 0000000000000068.page
-rw-r--r-- 1 root root   16384 Aug 20 22:53 0000000000000069.page
-rw-r--r-- 1 root root   16384 Aug 20 22:53 0000000000000070.page
-rw-r--r-- 1 root root   16384 Aug 20 22:53 0000000000000071.page
-rw-r--r-- 1 root root   16384 Aug 20 22:53 0000000000000072.page
-rw-r--r-- 1 root root   16384 Aug 20 22:53 0000000000000073.page
-rw-r--r-- 1 root root   16384 Aug 20 22:53 0000000000000074.page
-rw-r--r-- 1 root root   16384 Aug 20 22:53 0000000000000075.page
-rw-r--r-- 1 root root   16384 Aug 20 22:53 0000000000000076.page
-rw-r--r-- 1 root root   16384 Aug 20 22:53 0000000000000077.page
-rw-r--r-- 1 root root   49152 Aug 20 22:53 0000000000000078.page
-rw-r--r-- 1 root root   49152 Aug 20 22:53 0000000000000079.page
-rw-r--r-- 1 root root   49152 Aug 20 22:53 0000000000000080.page
-rw-r--r-- 1 root root   49152 Aug 20 22:53 0000000000000081.page
-rw-r--r-- 1 root root   49152 Aug 20 22:53 0000000000000082.page
-rw-r--r-- 1 root root   49152 Aug 20 22:53 0000000000000083.page
-rw-r--r-- 1 root root   49152 Aug 20 22:53 0000000000000084.page
-rw-r--r-- 1 root root  753664 Aug 20 22:53 0000000000000085.page
-rw-r--r-- 1 root root   49152 Aug 20 22:53 0000000000000086.page
-rw-r--r-- 1 root root   49152 Aug 20 22:53 0000000000000087.page
-rw-r--r-- 1 root root   49152 Aug 20 22:53 0000000000000088.page
-rw-r--r-- 1 root root   49152 Aug 20 22:53 0000000000000089.page
-rw-r--r-- 1 root root  901120 Aug 20 22:53 0000000000000110.page
-rw-r--r-- 1 root root 2097152 Aug 20 22:53 0000000000000115.page
-rw-r--r-- 1 root root   98304 Aug 20 22:53 0000000000000116.page
-rw-r--r-- 1 root root   98304 Aug 20 22:53 0000000000000117.page
-rw-r--r-- 1 root root   98304 Aug 20 22:53 0000000000000118.page
-rw-r--r-- 1 root root   98304 Aug 20 22:53 0000000000000119.page
-rw-r--r-- 1 root root   49152 Aug 20 22:53 0000000000000120.page
-rw-r--r-- 1 root root   98304 Aug 20 22:53 0000000000000121.page
-rw-r--r-- 1 root root   98304 Aug 20 22:53 0000000000000122.page
-rw-r--r-- 1 root root   98304 Aug 20 22:53 0000000000000123.page
-rw-r--r-- 1 root root   98304 Aug 20 22:53 0000000000000124.page
-rw-r--r-- 1 root root   16384 Aug 20 22:53 18446744069414584320.page
[root@localhost FIL_PAGE_INDEX]# 

分析数据字典

[root@localhost recovery_MySQL]# ./recover_dictionary.sh

Generating dictionary tables dumps... OK
Creating test database ... Warning: Using a password on the command line interface can be insecure.
OK
Creating dictionary tables in database test:
SYS_TABLES ... Warning: Using a password on the command line interface can be insecure.
OK
SYS_COLUMNS ... Warning: Using a password on the command line interface can be insecure.
OK
SYS_INDEXES ... Warning: Using a password on the command line interface can be insecure.
OK
SYS_FIELDS ... Warning: Using a password on the command line interface can be insecure.
OK
All OK
Loading dictionary tables data:
SYS_TABLES ... Warning: Using a password on the command line interface can be insecure.
34 recs OK
SYS_COLUMNS ... Warning: Using a password on the command line interface can be insecure.
3061 recs OK
SYS_INDEXES ... Warning: Using a password on the command line interface can be insecure.
206 recs OK
SYS_FIELDS ... Warning: Using a password on the command line interface can be insecure.
206 recs OK
All OK

关于MySQL数据字典恢复,也可以参考另外一篇文章:使用工具直接抽取MySQL数据字典

查看数据库中记录情况

[root@localhost recovery_MySQL]# MySQL -uroot -p123456
Warning: Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 34954
Server version: 5.6.21 MySQL Community Server (GPL)

Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL> use test;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MySQL> show tables;
+----------------+
| Tables_in_test |
+----------------+
| SYS_COLUMNS    |
| SYS_FIELDS     |
| SYS_INDEXES    |
| SYS_TABLES     |
+----------------+
4 rows in set (0.00 sec)

MySQL> SELECT NAME,ID from SYS_TABLES;
+-------------------------+----+
| NAME                    | ID |
+-------------------------+----+
| cnywmcom/zx_account_log | 31 |
| cnywmcom/zx_area_code   | 32 |
| cnywmcom/zx_goods_group | 33 |
| cnywmcom/zx_manage_type | 34 |
| cnywmcom/zx_order_goods | 35 |
| cnywmcom/zx_order_info  | 36 |
| cnywmcom/zx_param       | 37 |
| cnywmcom/zx_users       | 46 |
| cnywmcom/zx_user_type   | 38 |
| SYS_FOREIGN             | 11 |
| SYS_FOREIGN_COLS        | 12 |
+-------------------------+----+
11 rows in set (0.00 sec)

MySQL> select * from SYS_INDEXES;
+----------+-----+-----------------+----------+------+-------+---------+
| TABLE_ID | ID  | NAME            | N_FIELDS | TYPE | SPACE | PAGE_NO |
+----------+-----+-----------------+----------+------+-------+---------+
|       11 |  11 | ID_IND          |        1 |    3 |     0 |      46 |
|       11 |  12 | FOR_IND         |        1 |    0 |     0 |      47 |
|       11 |  13 | REF_IND         |        1 |    0 |     0 |      48 |
|       12 |  14 | ID_IND          |        2 |    3 |     0 |      49 |
|       31 |  65 | PRIMARY         |        1 |    3 |     0 |      50 |
|       31 |  66 | user_id         |        1 |    0 |     0 |     216 |
|       32 |  67 | PRIMARY         |        1 |    3 |     0 |      52 |
|       33 |  68 | PRIMARY         |        1 |    3 |     0 |     205 |
|       34 |  69 | PRIMARY         |        1 |    3 |     0 |      54 |
|       35 |  70 | PRIMARY         |        1 |    3 |     0 |      55 |
|       35 |  71 | order_id        |        1 |    0 |     0 |      56 |
|       35 |  72 | goods_id        |        1 |    0 |     0 |      57 |
|       36 |  73 | PRIMARY         |        1 |    3 |     0 |      59 |
|       36 |  74 | order_sn        |        1 |    2 |     0 |      60 |
|       36 |  75 | user_id         |        1 |    0 |     0 |      61 |
|       36 |  76 | order_status    |        1 |    0 |     0 |      62 |
|       36 |  77 | shipping_status |        1 |    0 |     0 |      63 |
|       36 |  78 | pay_status      |        1 |    0 |     0 |     192 |
|       36 |  79 | shipping_id     |        1 |    0 |     0 |     193 |
|       36 |  80 | pay_id          |        1 |    0 |     0 |     194 |
|       36 |  81 | extension_code  |        2 |    0 |     0 |     195 |
|       36 |  82 | agency_id       |        1 |    0 |     0 |     203 |
|       37 |  83 | PRIMARY         |        1 |    3 |     0 |     196 |
|       38 |  84 | PRIMARY         |        1 |    3 |     0 |     206 |
|       46 | 120 | PRIMARY         |        1 |    3 |     0 |      58 |
|       46 | 121 | user_name       |        1 |    2 |     0 |     256 |
|       46 | 122 | email           |        1 |    0 |     0 |     257 |
|       46 | 123 | parent_id       |        1 |    0 |     0 |     258 |
|       46 | 124 | flag            |        1 |    0 |     0 |     259 |
+----------+-----+-----------------+----------+------+-------+---------+
29 rows in set (0.00 sec)

通过这里,我们就可以明确的知道,我们需要恢复的表的page是多少了,这里举例说明恢复表cnywmcom.zx_account_log,我们需要去分析65号page

分析表恢复

[root@localhost recovery_MySQL]# ./c_parser -5f pages-ibdata1/FIL_PAGE_INDEX/0000000000000065.page -t dictionary/zx_account_log.sql|more
-- Page id: 223, Format: COMPACT, Records list: Invalid, Expected records: (0 7)
0B0C2000101C    55000230000000  zx_account_log  2979181 270888  "0"0"0.00"      "0.00"  "0.00"  2147483649      ""      0       ""      "0.00"  "-10643256.27"  "06."   "06."   "0782
7251.51"        "0.5"   "0.5"   "0.5"   "0.5"
000000042228    00000001040135  zx_account_log  561     1       "0.00"  "0.00"  "0.00"  "1.00"  "0.00"  1436840718      "会员注册"      99      "13818289939"   "1.00"  "0.00"  "0.00"  "0.00
"       "0.00"  "0.00"  "0.00"  "0.00"  "0.00"
000000042228    0000000104015A  zx_account_log  562     136     "0.00"  "0.00"  "0.00"  "1.00"  "0.00"  1436841067      "会员注册"      99      "17828025855"   "1.00"  "0.00"  "0.00"  "0.00
"       "0.00"  "0.00"  "0.00"  "0.00"  "0.00"
000000042228    0000000104017F  zx_account_log  563     137     "0.00"  "0.00"  "0.00"  "1.00"  "0.00"  1436842239      "会员注册"      99      "18617157667"   "1.00"  "0.00"  "0.00"  "0.00
"       "0.00"  "0.00"  "0.00"  "0.00"  "0.00"
000000042228    000000010401A4  zx_account_log  564     139     "0.00"  "0.00"  "0.00"  "1.00"  "0.00"  1436846738      "会员注册"      99      "18113070688"   "1.00"  "0.00"  "0.00"  "0.00
"       "0.00"  "0.00"  "0.00"  "0.00"  "0.00"
000000042228    000000010401C9  zx_account_log  565     1       "0.00"  "0.00"  "0.00"  "1.00"  "0.00"  1436848523      "会员注册"      99      "13623646573"   "1.00"  "0.00"  "0.00"  "0.00
"       "0.00"  "0.00"  "0.00"  "0.00"  "0.00"

至此该表的数据已经恢复出来,剩下任务就是把数据保存为文件,并且导入到新库中.然后依次处理相关表.至此完成这次drop database的恢复.在恢复过程中,遇到不少坑,比如有些记录在对应的page中无法找到,需要进行额外处理.对于乱码问题需要进一步处理等.通过一系列的恢复,给客户恢复了所有核心表,实现核心数据0丢失.通过这次的恢复,已经证明我们不光是Oracle恢复中的行业强者,在MySQL数据库的各种故障中,我们也有立足之地.如果有MySQL数据库的恢复(误删除数据/delete,误删除表/drop table,误截断表/truncate table,误删除数据库/drop database,MySQL不能启动,ibdata1文件损坏/丢失等MySQL各种恢复)请求,如果您遇到MySQL恢复问题无法自行解决,请联系我们提供专业服务,最大程度减小您的损失:

Phone:17813235971    Q Q:107644445    E-Mail:dba@xifenfei.com

mysql数据库被加密恢复

有客户mysql数据库被加密,加密信息如下
20200129162256


由于是mysql 5.6的版本,默认情况innodb引擎,Innodb_file_per_table参数默认为true,因此数据为每个表存在为一个单独的ibd文件中,让客户提供需要恢复的表的ibd被加密文件
20200129162048


通过一系列底层操作,实现数据完美恢复
1
2


如果是Innodb_file_per_table参数为false(5.6之前版本默认为false),需要通过ibdata文件进行恢复
如果您的数据库(oracle,mysql sql server)不幸被比特币加密,可以联系我们
Tel/微信:17813235971    Q Q:107644445 QQ咨询惜分飞    E-Mail:dba@xifenfei.com提供专业的解密恢复服务.

Assistant: Download Reference for Oracle Database/GI PSU, SPU(CPU), Bundle Patches, Patchsets and Base Releases-202001

 

Base Releases
 19c  Oracle Database Software Download Page
 18c  Oracle Database Software Download Page
 12.2.0.1.0  Oracle Database Software Download Page
 12.1.0.1.0  Raise a non-technical SR for Physical Shipment or Download URL. Refer Doc ID 1071023.1
 11.2.0.1.0  Oracle Database Software Download Page
 Versions older than 11.2.0.1.0  Raise a non-technical SR for Physical Shipment or Download URL. Refer Doc ID 1071023.1

 

Patchsets
12.1.0.2 (12.1.0.2.0 PATCH SET FOR ORACLE DATABASE SERVER) 21419221
11.2.0.4 (11.2.0.4.0 PATCH SET FOR ORACLE DATABASE SERVER) 13390677
11.2.0.3 (11.2.0.3.0 PATCH SET FOR ORACLE DATABASE SERVER) 10404530
11.2.0.2 (11.2.0.2.0 PATCH SET FOR ORACLE DATABASE SERVER) 10098816
11.1.0.7 (11.1.0.7.0 PATCH SET FOR ORACLE DATABASE SERVER) 6890831
10.2.0.5 (10.2.0.5 PATCH SET FOR ORACLE DATABASE SERVER) 8202632
A10.2.0.4 (10.2.0.4.0 PATCH SET FOR ORACLE DATABASE SERVER) 6810189
B10.2.0.3 (10.2.0.3 PATCH SET FOR ORACLE DATABASE SERVER) 5337014
10.2.0.2 (10.2.0.2 PATCH SET FOR ORACLE DATABASE SERVER) 4547817
10.1.0.5 (10.1.0.5 PATCH SET FOR ORACLE DATABASE SERVER) 4505133
10.1.0.4 (10.1.0.4 PATCH SET FOR ORACLE DATABASE SERVER) 4163362
10.1.0.3 (10.1.0.3 PATCH SET FOR ORACLE DATABASE SERVER) 3761843
9.2.0.8 (9.2.0.8 PATCH SET FOR ORACLE DATABASE SERVER) 4547809
9.2.0.7 (9.2.0.7 PATCH SET FOR ORACLE DATABASE SERVER) 4163445
9.2.0.6 (9.2.0.6 PATCH SET FOR ORACLE DATABASE SERVER) 3948480
9.2.0.5 (ORACLE 9I DATABASE SERVER RELEASE 2 – PATCH SET 4 VERSION 9.2.0.5.0) 3501955
9.2.0.4 (9.2.0.4 PATCH SET FOR ORACLE DATABASE SERVER) 3095277
9.2.0.3 (9.2.0.3 PATCH SET FOR ORACLE DATABASE SERVER) 2761332
9.2.0.2 (9.2.0.2 PATCH SET FOR ORACLE DATABASE SERVER) 2632931
9.0.1.5 (9.0.1.5 PATCHSET) 3301544
9.0.1.4 (9.0.1.4 PATCH SET FOR ORACLE DATABASE SERVER) 2517300
9.0.1.3 (9.0.1.3. PATCH SET FOR ORACLE DATA SERVER) 2271678
8.1.7.4 (8.1.7.4 PATCH SET FOR ORACLE DATA SERVER) 2376472
8.1.7.3 (8.1.7.3 PATCH SET FOR ORACLE DATA SERVER) 2189751
8.1.7.2 (8.1.7.2.1 PATCH SET FOR ORACLE DATA SERVER) 1909158

 
 

19.0.0.0
 Description  Database Update  GI Update  Windows Bundle Patch
 JAN2020 (19.6.0.0.0) 30557433  30501910  30445947
 OCT2019 (19.5.0.0.0) 30125133  30116789  30151705
 JUL2019 (19.4.0.0.0) 29834717  29708769   NA
 APR2019 (19.3.0.0.0) 29517242  29517302   NA

 
 
 

19.0.0.0
 Release  DB Revision 1  DB Revision 2  GI Revision 1  GI Revision 2
 JAN2020 30446054 (19.5.1.0.0) 30446228 (19.4.2.0.0) 30464035 (19.5.1.0.0) 30463911 (19.4.2.0.0)
 OCT2019 30080447 (19.4.1.0.0) 30087906 (19.3.2.0.0) 30134717 (19.4.1.0.0) 30135696(19.3.2.0.0)

 
 
 

18.0.0.0
 Description  Database Update  GI Update  Windows Bundle Patch
 JAN2020 (18.9.0.0.0)  30480385  30480702  30445951
 OCT2019 (18.8.0.0.0)  30112122  30116795  30150321
 JUL2019 (18.7.0.0.0)  29757256  29708703  29859180
 APR2019 (18.6.0.0.0)  29301631  29301682  29589622
 JAN2019 (18.5.0.0.0)  28822489  28828717  29124511
 OCT2018 (18.4.0.0.0)  28655784  28659165  NA
 JUL2018 (18.3.0.0.0)  28090523  28096386  NA
 APR2018 (18.2.0.0.0)  27676517  27681568  NA

 
 

18.0.0.0
 Release  DB Revision 1  DB Revision 2  GI Revision 1  GI Revision 2
 JAN2020 30445895 (18.8.1.0.0) 30446239(18.7.2.0.0) 30463999 (18.8.1.0.0) 30463931 (18.7.2.0.0)
 OCT2019 30080518 (18.7.1.0.0) 30087881(18.6.2.0.0) 30135098 (18.7.1.0.0) 30134851 (18.6.2.0.0)
 JUL2019 29708235 (18.6.1.0.0) 29708437(18.5.2.0.0) 29708736 (18.6.1.0.0) 29708805 (18.5.2.0.0)
 APR2019 29230887 (18.5.1.0.0) 29230809(18.4.2.0.0) 29231062 (18.5.1.0.0) 29230841 (18.4.2.0.0)
 JAN2019 28822587 (18.4.1.0.0) 28790643(18.3.2.0.0) 28833172 (18.4.1.0.0) 28833251 (18.3.1.0.0)
 OCT2018 28507480 (18.3.1.0.0) 28601267(18.2.2.0.0) 28660077 (18.3.1.0.0) 28702032 (18.2.2.0.0)
 JUL2018 28346593 (18.2.1.0.0)   28276290 (18.2.1.0.0)  

 
 

12.2.0.1
 Release  DB Update  DB Revision 1  DB Revision 2  GI Update  GI Revision 1  GI Revision 2
 JAN2020  30593149 (12.2.0.1.200114)  30445968 (OCT2020)  30446254 (JUL2019) 30501932 (12.2.0.1.200114)  30464069 (OCT2019)  30463942 (JUL2019)
 OCT2019  30138470 (12.2.0.1.191015)  30087824 (JUL2019)  30087848 (APR2019) 30116802 (12.2.0.1.191015)  30135070 (JUL2019)  30134879 (APR2019)
 JUL2019  29757449 (12.2.0.1.190716)  29708381 (APR2019)  29708478 (JAN2019) 29708720 (12.2.0.1.190716)  29708786 (APR2019)  29708822 (JAN2019)
 APR2019  29314339 (12.2.0.1.190416)  29230950 (JAN2019)  29230821 (OCT2018) 29301687 (12.2.0.1.190416)  29231084 (JAN2019)  29230829 (OCT2018)
 JAN2019  28822515 (12.2.0.1.190115)  28822638 (OCT2018)  28790640 (JUL2018) 28828733 (12.2.0.1.190115)  28833185 (OCT2018)  28833258 (JUL2018)
 OCT2018  28662603 (12.2.0.1.181016)  28507553 (JUL2018)  28507749 (APR2018)  28714316 (12.2.0.1.181016)  28507693 (JUL2018)  28507711 (APR2018)
 JUL2018  28163133 (12.2.0.1.180717)  27848049 (APR2018)  27872031 (JAN2018)  NA  28251239 (APR2018)  28251142 (JAN2018)
 APR2018  27674384 (12.2.0.1.180417)  27856791 (JAN2018)  27427077 (OCT2017)  27468969 (12.2.0.1.180417)  27696736 (JAN2018)  27696758 (OCT2017)
 JAN2018  27105253 (12.2.0.1.180116)  27013510(OCT2017)  27013506 (JUL2017)  27100009 ((12.2.0.1.180116)  27224075 (OCT2017)  27224023 (JUL2017)
 OCT2017  26710464 (12.2.0.1.171017)  26518812 (JUL2017)    26737266 (12.2.0.1.171017)  26878187 (JUL2017)  
 JUL2017  26123830 (12.2.0.1.170718)      26133434((12.2.0.1.170718)    

 
 

12.1.0.2
 Description  PSU  GI PSU  Proactive Bundle Patch  Bundle Patch(Windows 32bit & 64bit)
 JAN2010 (12.1.0.2.200114) 30340202 30464119 30464171 30455401
 OCT2019 (12.1.0.2.191015) 29918340 30070257 30070242 30049606
 JUL2019 (12.1.0.2.190716) 29494060 29698592 29698629 29831650
 APR2019 (12.1.0.2.190416) 29141015 29176115 29176139 29413116
 JAN2019 (12.1.0.2.190115) 28729169 28813884 28833531 28810679
 NOV2018 (12.1.0.2.181130)  NA  NA  NA 28810544 (64bit)
 OCT2018 (12.1.0.2.181016)  28259833  28349311  28349951  28563501
 JUL2018 (12.1.0.2.180717)  27547329  27967747  27968010  27937907
 APR2018 (12.1.0.2.180417)  27338041  27468957  27486326  27440294
 JAN2018 (12.1.0.2.180116)  26925311  27010872  27010930  27162953
 OCT2017 (12.1.0.2.171017)  26713565  26635815  26635880  26720785
 AUG2017(12.1.0.2.170814)  26609783  26610308  26610322  26161726
 JUL2017 (12.1.0.2.170718)  25755742  25901062  26022196  26161724
 APR2017 (12.1.0.2.170418)  25171037  25434003  25433352  25632533
 JAN2017 (12.1.0.2.170117)  24732082  24917825  24968615  25115951
 OCT2016 (12.1.0.2.161018)  24006101  24412235  24448103  24591642
 JUL2016 (12.1.0.2.160719)  23054246  23273629  23273686  23530387
 APR2016 (12.1.0.2.160419)  22291127  22646084  22899531  22809813
 JAN2016 (12.1.0.2.160119)  21948354  22191349  22243551  22310559
 OCT2015  21359755(12.1.0.2.5)  21523234(12.1.0.2.5)  21744410(12.1.0.2.13)  21821214(12.1.0.2.10)
 JUL2015  20831110(12.1.0.2.4)  20996835(12.1.0.2.4)  21188742(12.1.0.2.10)  21126814(12.1.0.2.7)
 APR2015  20299023(12.1.0.2.3)  20485724(12.1.0.2.3)  20698050(12.1.0.2.7)  20684004(12.1.0.2.4)
 JAN2015  19769480(12.1.0.2.2)  19954978(12.1.0.2.2)  20141343(12.1.0.2.4)  19720843(12.1.0.2.1)
 OCT2014  19303936(12.1.0.2.1)  19392646(12.1.0.2.1)  19404326(12.1.0.2.1)  N/A

 
 

12.1.0.1
Description PSU GI PSU Bundle Patch
A B Windows 64 bit Windows 32 bit
JUL2016 (12.1.0.1.160719) 23054354 23273935 23273958 23530410
APR2016 (12.1.0.1.160419) 22291141 22654153 22654166 22839614
JAN2016 (12.1.0.1.160119) 21951844 22191492 22191511 22494866
OCT2015 21352619(12.1.0.1.9) 21551666(12.1.0.1.9) 21551685(12.1.0.1.9) 21744907 (12.1.0.1.21)
JUL2015 20831107(12.1.0.1.8) 20996901(12.1.0.1.8) 20996911(12.1.0.1.8) 21076681 (12.1.0.1.20)
APR2015 20299016(12.1.0.1.7) 20485762(12.1.0.1.7) 19971331(12.1.0.1.7) 20558101 (12.1.0.1.18)
JAN2015 19769486(12.1.0.1.6) 19971324(12.1.0.1.6) 19971331(12.1.0.1.6) 20160748 (12.1.0.1.16)
OCT2014 19121550(12.1.0.1.5) 19392372(12.1.0.1.5) 19392451(12.1.0.1.5) 19542943 (12.1.0.1.14)
JUL2014 18522516(12.1.0.1.4) 18705901(12.1.0.1.4) 18705972(12.1.0.1.4) 19062327 (12.1.0.1.11)
APR2014 18031528(12.1.0.1.3) 18139660(12.1.0.1.3) 18413105(12.1.0.1.3) 18448604 (12.1.0.1.7)
JAN2014 17552800(12.1.0.1.2) 17735306 (12.1.0.1.2) 17977915 (12.1.0.1.3)
OCT2013 17027533(12.1.0.1.1) 17272829 (12.1.0.1.1) 17363796(12.1.0.1.1) 17363795(12.1.0.1.1)

 
 

11.2.0.4
 Description  PSU  SPU(CPU)  GI PSU  Bundle Patch (Windows 32bit & 64bit)
 JAN2020 (11.2.0.4.200114)  30298532  30559616 30501155 30502376
 OCT2019 (11.2.0.4.191015)  29913194  N/A 30070097 30151661
 JUL2019 (11.2.0.4.190716)  29497421  N/A 29698727 29596609
 APR2019 (11.2.0.4.190416)  29141056 28790634 29255947 29218820
 JAN2019 (11.2.0.4.190115)  28729262 28790634 28813878  28761877
 OCT2018 (11.2.0.4.181016)  28204707  28364007  28429134  28265827
 JUL2018 (11.2.0.4.180717)  27734982  27870645  27967757  27695940
 APR2018 (11.2.0.4.180417)  27338049  26474853  27475913  27381640
 JAN2018 (11.2.0.4.180116)  26925576  N/A  27107360  27162965
 OCT2017 (11.2.0.4.171017)  26392168  26474853  26635745  26581376
 AUG2017 (11.2.0.4.170814)  26609445  N/A  26610246  26194138
 JUL2017 (11.2.0.4.170718)  25869727  25879656  26030799  26194136
 APR2017 (11.2.0.4.170418)  24732075  25369547  25476126  25632525
 JAN2017  N/A  N/A  N/A  N/A
 OCT2016 (11.2.0.4.161018)  24006111  24433711  24436338  24591646
 JUL2016 (11.2.0.4.160719)  23054359  23177648  23274134  23530402
 APR2016 (11.2.0.4.160419)  22502456  22502493  22646198  22839608
 JAN2016 (11.2.0.4.160119)  21948347  21972320  22191577  22310544
 OCT2015  21352635 (11.2.0.4.8)  21352646  21523375 (11.2.0.4.8)  21821802 (11.2.0.4.20)
 JUL2015  20760982 (11.2.0.4.7)  20803583  20996923 (11.2.0.4.7)  21469106 (11.2.0.4.18)
 APR2015  20299013 (11.2.0.4.6)  20299015  20485808 (11.2.0.4.6)  20544696 (11.2.0.4.15)
 JAN2015  19769489 (11.2.0.4.5)  19854503  19955028 (11.2.0.4.5)  20127071 (11.2.0.4.12)
 OCT2014  19121551 (11.2.0.4.4)  19271443  19380115 (11.2.0.4.4)  19651773 (11.2.0.4.10)
 JUL2014  18522509 (11.2.0.4.3)  18681862  18706472 (11.2.0.4.3)  18842982 (11.2.0.4.7)
 APR2014  18031668 (11.2.0.4.2)  18139690  18139609 (11.2.0.4.2)  18296644 (11.2.0.4.4)
 JAN2014  17478514 (11.2.0.4.1)  17551709  N/A  17987366 (11.2.0.4.1)

 
 
 
 

11.2.0.3
Description PSU SPU(CPU) GI PSU Bundle Patch (Windows 64bit) Bundle Patch (Windows 32bit)
JUL2015 20760997 (11.2.0.3.15) 20803576 20996944 (11.2.0.3.15) 21104036 21104035
APR2015 20299017 (11.2.0.3.14) 20299010 20485830 (11.2.0.3.14) 20420395 20420394
JAN2015 19769496 (11.2.0.3.13) 19854461 19971343 (11.2.0.3.13) 20233168 20233167
OCT2014 19121548 (11.2.0.3.12) 19271438 19440385 (11.2.0.3.12) 19618575 19618574
JUL2014 18522512 (11.2.0.3.11) 18681866 18706488 (11.2.0.3.11) 18940194 18940193
APR2014 18031683 (11.2.0.3.10) 18139695 18139678 (11.2.0.3.10) 18372244 18372243
JAN2014 17540582 (11.2.0.3.9) 17478415 17735354 (11.2.0.3.9) 18075406 17906981
OCT2013 16902043 (11.2.0.3.8) 17082364 17272731 (11.2.0.3.8) 17363850 17363844
JUL2013 16619892 (11.2.0.3.7) 16742095 16742216 (11.2.0.3.7) 16803775 16803774
APR2013 16056266 (11.2.0.3.6) 16294378 16083653 (11.2.0.3.6) 16345834 16345833
JAN2013 14727310 (11.2.0.3.5) 14841409 14727347 (11.2.0.3.5) 16042648 16042647
OCT2012 14275605 (11.2.0.3.4) 14390252 14275572 (11.2.0.3.4) 14613223 14613222
JUL2012 13923374 (11.2.0.3.3) 14038787 13919095 (11.2.0.3.3) 14223718 14223717
APR2012 13696216 (11.2.0.3.2) 13632717 13696251 (11.2.0.3.2) 13885389 13885388
JAN2012 13343438 (11.2.0.3.1) 13466801 13348650 (11.2.0.3.1) 13413168 13413167

 

11.2.0.2
Description PSU SPU(CPU) GI PSU Bundle Patch (Windows 64bit) Bundle Patch (Windows 32bit)
OCT2013 17082367 (11.2.0.2.12) 17082375 17272753 (11.2.0.2.12) 17363838 17363837
JUL2013 16619893 (11.2.0.2.11) 16742100 16742320 (11.2.0.2.11) 16345852 16345851
APR2013 16056267 (11.2.0.2.10) 16294412 16166868 (11.2.0.2.10) 16345846 16345845
JAN2013 14727315 (11.2.0.2.9) 14841437 14841385 (11.2.0.2.9) 16100399 16100398
OCT2012 14275621 (11.2.0.2.8) 14390377 14390437 (11.2.0.2.8) 14672268 14672267
JUL2012 13923804 (11.2.0.2.7) 14038791 14192201 (11.2.0.2.7) 14134043 14134042
APR2012 13696224 (11.2.0.2.6) 13632725 13696242 (11.2.0.2.6) 13697074 13697073
JAN2012 13343424 (11.2.0.2.5) 13343244 13653086 (11.2.0.2.5) 13413155 13413154
OCT2011 12827726 (11.2.0.2.4) 12828071 12827731 (11.2.0.2.4) 13038788 13038787
JUL2011 12419331 (11.2.0.2.3) 12419321 12419353 (11.2.0.2.3) 12714463 12714462
APR2011 11724916 (11.2.0.2.2) 11724984 12311357 (11.2.0.2.2) 11896292 11896290
JAN2011 10248523 (11.2.0.2.1) N/A N/A 10432053 10432052

 

11.2.0.1
Description PSU CPU Bundle Patch (Windows 64bit) Bundle Patch (Windows 32bit)
JUL2011 12419378 (11.2.0.1.6) 12419278 12429529 12429528
APR2011 11724930 (11.2.0.1.5) 11724991 11731176 11883240
JAN2011 10248516 (11.2.0.1.4) 10249532 10432045 10432044
OCT2010 9952216 (11.2.0.1.3) 9952260 10100101 10100100
JUL2010 9654983 (11.2.0.1.2) 9655013 9736865 9736864
APR2010 9352237 (11.2.0.1.1) 9369797 N/A N/A

 

10.2.0.5
Description PSU SPU(CPU) Bundle Patch (Windows 64bit) Bundle Patch (Windows 32bit) Bundle Patch (Windows Itanium)
JUL2015 20299014(10.2.0.5.19) 20299021 20420387 20420386 N/A
APR2015 N/A N/A N/A N/A N/A
JAN2015 19769505(10.2.0.5.18) 19854436 20126868 20126867 N/A
OCT2014 19274523(10.2.0.5.17) 19274521 19618565 19618563 N/A
JUL2014 18522511(10.2.0.5.16) 18681879 18940198 18940196 N/A
APR2014 18031728(10.2.0.5.15) 18139709 18372261 18372259 N/A
JAN2014 17465584(10.2.0.5.14) 17551414 17906974 17906972 N/A
OCT2013 17082365(10.2.0.5.13) 17082371 N/A 17363822 N/A
JUL2013 16619894(10.2.0.5.12) 16742123 16803782 16803780 16803781
APR2013 16056270(10.2.0.5.11) 16270946 16345857 16345855 16345856
JAN2013 14727319(10.2.0.5.10) 14841459 15848062 15848060 15848061
OCT2012 14275629(10.2.0.5.9) 14390396 14553358 14553356 14553357
JUL2012 13923855(10.2.0.5.8) 14038805 14134053 14134051 14134052
APR2012 13632743(10.2.0.5.7) 13632738 13654815 13654814 13870404
JAN2012 13343471(10.2.0.5.6) 13343467 13460968 13460967 N/A
OCT2011 12827745(10.2.0.5.5) 12828105 N/A 12914911 N/A
JUL2011 12419392(10.2.0.5.4) 12419258 12429524 12429523 N/A
APR2011 11724962(10.2.0.5.3) 11725006 12328269 12328268 N/A
JAN2011 10248542(10.2.0.5.2) 10249537 10352673 10352672 N/A
OCT2010 9952230(10.2.0.5.1) 9952270 10099855 10058290 N/A

 

10.2.0.4
Description PSU SPU(CPU) Bundle Patch (Windows 32bit) Bundle Patch (Windows 64bit) Bundle Patch (Windows Itanium)
JUL2013 16619897 (10.2.0.4.17) 16742253 N/A N/A N/A
APR2013 16056269 (10.2.0.4.16) 16270931 N/A N/A N/A
JAN2013 14736542 (10.2.0.4.15) 14841471 N/A N/A N/A
OCT2012 14275630 (10.2.0.4.14) 14390410 N/A N/A N/A
JUL2012 13923851 (10.2.0.4.13) 14038814 N/A N/A N/A
APR2012 12879933 (10.2.0.4.12) 12879926 13928775 13928776 N/A
JAN2012 12879929 (10.2.0.4.11) 12879912 13654060 N/A N/A
OCT2011 12827778 (10.2.0.4.10) 12828112 12914908 12914910 12914909
JUL2011 12419397 (10.2.0.4.9) 12419249 12429519 12429521 12429520
APR2011 11724977 (10.2.0.4.8) 11725015 12328501 12328503 12328502
JAN2011 10248636 (10.2.0.4.7) 10249540 10349197 10349200 10349198
OCT2010 9952234 (10.2.0.4.6) 9952272 10084980 10084982 10084981
JUL2010 9654991 (10.2.0.4.5) 9655017 9777076 9777078 9777077
APR2010 9352164 (10.2.0.4.4) 9352191 9393548 9393550 9393549
JAN2010 9119284 (10.2.0.4.3) 9119226 9169457 9169460 9169458
OCT2009 8833280 (10.2.0.4.2) 8836308 8880857 8880861 8880858
JUL2009 8576156 (10.2.0.4.1) 8534387 8559466 8559467 8541782
APR2009 N/A 8290506 8307237 8307238 8333678
JAN2009 N/A 7592346 7584866 7584867 N/A
OCT2008 N/A 7375644 7386320 7386321 N/A
JUL2008 N/A 7150470 7218676 7218677 N/A

 

10.2.0.3
Description CPU (Unix/Linux) Bundle Patch (Windows 32bit) Bundle Patch (Windows Itanium) Bundle Patch (Windows 64bit)
JAN2009 7592354 7631956 7631958 7631957
OCT2008 7369190 7353782 7353784 7353785
JUL2008 7150622 7252496 7252497 7252498
APR2008 6864068 6867054 6867055 6867056
JAN2008 6646853 6637237 6637238 6637239
OCT2007 6394981 6430171 6430173 6430174
JUL2007 6079591 6116131 6038242 6116139
APR2007 5901891 5948242 5916262 5948243
JAN2007 5881721 5846376 5846377 5846378

 

10.2.0.2
Description CPU (Unix/Linux) Bundle Patch (Windows 32bit) Bundle Patch (Windows 64bit) Bundle Patch (Windows Itanium)
JAN2009 7592355 N/A N/A N/A
OCT2008 7375660 N/A N/A N/A
JUL2008 7154083 N/A N/A N/A
APR2008 6864071 N/A N/A N/A
JAN2008 6646850 N/A N/A N/A
OCT2007 6394997 6397028 6397030 6397029
JUL2007 6079588 6013105 6013121 6013118
APR2007 5901881 5912173 5912179 5912176
JAN2007 5689957 5716143 5699839 5699824
OCT2006 5490848 5502226 5500921 5500894
JUL2006 5225799 5251025 5251028 5251026
APR2006 5079037 5140461 5140567 5140508

 

10.2.0.1
Description CPU (Unix/Linux) Bundle Patch (Windows 32bit) Bundle Patch (Windows 64bit) Bundle Patch (Windows Itanium)
APR2007 5901880 N/A N/A N/A
JAN2007 5689937 5695784 5695786 5695785
OCT2006 5490846 5500927 5500954 5500951
JUL2006 5225798 5239698 5239701 5239699
APR2006 5049080 5059238 5059261 5059251
JAN2006 4751931 4751539 4770480 4751549

 

10.1.0.5
Description CPU (Unix/Linux) Bundle Patch (Windows 32bit) Bundle Patch (Windows Itanium)
JAN2012 13343482 13413002 13413003
OCT2011 12828135 12914905 12914906
JUL2011 12419228 12429517 12429518
APR2011 11725035 11731119 11731120
JAN2011 N/A N/A N/A
OCT2010 9952279 10089559 10089560
JUL2010 9655023 9683651 9683652
APR2010 9352208 9390288 9390289
JAN2010 9119261 9187104 9187105
OCT2009 8836540 8785211 8785212
JUL2009 8534394 8656224 8656226
APR2009 8290534 8300356 8300360
JAN2009 7592360 7486619 7586049
OCT2008 7375686 7367493 7367494
JUL2008 7154097 7047034 7047037
APR2008 6864078 6867107 6867108
JAN2008 6647005 6637274 6637275
OCT2007 6395024 6408393 6408394
JUL2007 6079585 6115804 6115818
APR2007 5901877 5907304 5907305
JAN2007 5689908 5716295 5634747
OCT2006 5490845 5500883 5500885
JUL2006 5225797 5251148 5251140
APR2006 5049074 5057606 5057609
JAN2006 4751932 4882231 4882236

 

10.1.0.4
Description CPU (Unix/Linux) Bundle Patch (Windows 32bit) Bundle Patch (Windows Itanium)
APR2007 5901876 5909871 5909879
JAN2007 5689894 5695771 5695772
OCT2006 5490844 5500878 5500880
JUL2006 5225796 5239736 5239737
APR2006 5049067 5059200 5059227
JAN2006 4751928 4751259 4745040
OCT2005 4567866 4579182 4579188
JUL2005 4392423 4440706 4404600
APR2005 4210374 4287619 4287611

 

10.1.0.3
Description CPU (Unix/Linux) Bundle Patch (Windows 32bit) Bundle Patch (Windows Itanium)
JAN2007 5923277 N/A N/A
OCT2006 5566825 N/A N/A
JUL2006 5435164 N/A N/A
APR2006 5158022 N/A N/A
JAN2006 4751926 4741077 4741084
OCT2005 4567863 4567518 4567523
JUL2005 4392409 4389012 4389014
APR2005 4193286 4269715 4158888
JAN2005 4003062 4074232 3990812

 

10.1.0.2
Description CPU (Unix/Linux) Bundle Patch (Windows 32bit) Bundle Patch (Windows Itanium)
APR2005 4193293 4181849 4213305
JUL2005 4400766 4388944 4388948
JAN2005 4003051 4104364 4083038

 

9.2.0.8
Description CPU (Unix/Linux) Bundle Patch (Windows 32bit) Bundle Patch (Windows Itanium)
JUL2010 9655027 9683644 9683645
APR2010 9352224 9390286 N/A
JAN2010 9119275 9187106 N/A
OCT2009 8836758 8785185 8785186
JUL2009 8534403 8427417 8427418
APR2009 8290549 8300340 8300346
JAN2009 7592365 7703210 7703212
OCT2008 7375695 7394394 7394402
JUL2008 7154111 7047026 7047029
APR2008 6864082 6867138 6867139
JAN2008 6646842 6637265 6637266
OCT2007 6395038 6417013 6417014
JUL2007 6079582 6130293 6130295
APR2007 5901875 5916268 5916275
JAN2007 N/A N/A N/A
OCT2006 5490859 5652380 5639519

 

9.2.0.7
Description CPU (Unix/Linux) Bundle Patch (Windows 32bit) Bundle Patch (Windows Itanium)
JUL2007 6079579 6146759 6146748
APR2007 5901872 5907274 5907275
JAN2007 5689875 5654905 5654909
OCT2006 5490841 5500873 5500874
JUL2006 5225794 5250980 5250981
APR2006 5049060 5064365 5064364
JAN2006 4751923 4751528 4741074
OCT2005 4567854 4579590 4579599
JUL2005 4547566 N/A N/A

 

9.2.0.6
Description CPU (Unix/Linux) Bundle Patch (Windows 32bit) Bundle Patch (Windows Itanium)
OCT2006 5490840 5500865 5500871
JUL2006 5225793 5239794 5239793
APR2006 5049051 5059614 5059615
JAN2006 4751921 4751261 4751262
OCT2005 4567846 4579093 4579097
JUL2005 4392392 4445852 4401917
APR2005 4193295 4269928 4213298

 

9.2.0.5
Description CPU (Unix/Linux) Bundle Patch (Windows 32bit) Bundle Patch (Windows Itanium)
OCT2006 5689708 N/A N/A
JUL2006 5435138 N/A N/A
APR2006 5219762 N/A N/A
OCT2005 4560421 N/A N/A
JUL2005 4392256 4387563 4391819
APR2005 4193299 4195791 4214192
JAN2005 4003006 4104374 3990809

 

9.2.0.4
Description CPU (Unix/Linux) Bundle Patch (Windows 32bit) Bundle Patch (Windows Itanium)
JAN2005 4002994 4104369 4083202

 

8.1.7.4
Description CPU (Unix/Linux) Bundle Patch (Windows 32bit)
JAN2007 5689799 5686514
OCT2006 5490835 5496067
JUL2006 5225788 5236412
APR2006 5045247 5057601
JAN2006 4751906 4751570
OCT2005 4560405 4554818
JUL2005 4392446 4437058
APR2005 4193312 4180163
JAN2005 4002909 3921893

参考:Assistant: Download Reference for Oracle Database/GI Update, Revision, PSU, SPU(CPU), Bundle Patches, Patchsets and Base Releases (文档 ID 2118136.2)

.WECANHELP加密数据库恢复

接到网络恢复请求,oracle dmp文件被加密,文件名为:2020_01_10_16_00_00.DMP.id_2251820718_.WECANHELP,_RESTORE FILES_.txt文件内容为:

*** ALL YOUR WORK AND PERSONAL FILES HAVE BEEN ENCRYPTED ***
To decrypt your files you need to buy the special software ?"Nemesis decryptor"
You can find out the details/buy decryptor + key/ask questions by email:
        wecanhelpyou@elude.in, w3canh3lpy0u@cock.li OR wecanh3lpyou2@cock.li
IMPORTANT!
DON'T TRY TO RESTORE YOU FILES BY YOUR SELF, YOU CAN DAMAGE FILES!
If within 24 hours you did not receive an answer by email, be sure to write to Jabber: icanhelp@xmpp.jp
Your personal ID: 2251820718

通过对加密的dmp进行分析
20200117180530
我们确定,可以通过数据库技术层面对其进行恢复,实现最大限度抢救客户数据
20200117181832


如果您的数据库(oracle,mysql sql server)不幸被比特币加密,可以联系我们Tel/微信:17813235971    Q Q:107644445QQ咨询惜分飞    E-Mail:dba@xifenfei.com提供专业的解密恢复服务.

再次提醒plsql dev勒索事件

在2016年发现plsql dev被注入恶意脚本,导致数据库被破坏的事件,我当时写过相关分析blog(plsql dev引起的数据库被黑勒索比特币实现原理分析和解决方案),最近又接到两个客户类似故障请求,分享这次处理经历,提醒大家注意
aler日志报错

Mon Oct 21 16:13:06 2019
Errors in file /u01/app/oracle/diag/rdbms/xff/xff1/trace/xff1_ora_68593.trc:
ORA-00604: error occurred at recursive SQL level 1
ORA-20315: 你的数据库已被SQL RUSH Team锁死  发送5个比特币到这个地址 166xk1FXMB2g8JxBVF5T4Aw1Z5JaZ6vrSE (大小写一致)
  之后把你的Oracle SID邮寄地址 sqlrush@mail.com 我们将让你知道如何解锁你的数据库
Hi buddy, your database was hacked by SQL RUSH Team, send 5 bitcoin to address
166xk1FXMB2g8JxBVF5T4Aw1Z5JaZ6vrSE (case sensitive),  after that send your Oracle SID to mail
address sqlrush@mail.com, we will let you know how to unlock your database.
ORA-06512: at "XIFENFEI.DBMS_CORE_INTERNAL         ", line 25
ORA-06512: at line 2

证明该库在2019年10月份就已经被注入恶意脚本,只是由于该库无专业维护,没有定期检查,不然该问题再就被发现.直到前几天有数据丢失影响业务运行,才开始找原因,发现该问题.

查询相关恶意脚本创建时间

SQL> select owner||'.'||object_name,to_char(created,'yyyy-mm-dd hh24:mi:ss')
 2  from dba_objects where object_name like 'DBMS_%_INTERNAL% ';
OWNER||'.'||OBJECT_NAME
-----------------------------------------------
TO_CHAR(CREATED,'YY
-------------------
XFF.DBMS_SUPPORT_INTERNAL
2019-11-19 11:29:38
XFF.DBMS_SUPPORT_INTERNAL
2019-11-19 11:29:38
XFF.DBMS_SYSTEM_INTERNAL
2019-11-19 11:29:39
XFF.DBMS_SYSTEM_INTERNAL
2019-11-19 11:29:39
XFF.DBMS_CORE_INTERNAL
2019-11-19 11:29:39
XFF.DBMS_CORE_INTERNAL
2019-11-19 11:29:39
XIFENFEI.DBMS_SUPPORT_INTERNAL
2019-10-21 15:49:06
XIFENFEI.DBMS_SUPPORT_INTERNAL
2019-10-21 15:49:06
XIFENFEI.DBMS_SYSTEM_INTERNAL
2019-10-21 15:49:06
XIFENFEI.DBMS_SYSTEM_INTERNAL
2019-10-21 15:49:06
XIFENFEI.DBMS_CORE_INTERNAL
2019-10-21 15:49:06
XIFENFEI.DBMS_CORE_INTERNAL
2019-10-21 15:49:06
12 rows selected.

证明在xifenfei和xff用户下面均已经被注入了恶意脚本(也可以通过alert日志分析出来类似结论)

生产truncate表job

SQL> select count(*) from dba_jobs;
  COUNT(*)
----------
  50283485
SQL> select count(job) from dba_jobs
where what like '%DBMS_STANDARD_FUN9%';  2
COUNT(JOB)
----------
  50283483

证明该库本身自带job只有2个,剩余全部是恶意脚本生成的job.

处理思路
1.保护现场:停掉监听,kill所有业务会话
2.job处理:禁止数据库启动任何job,kill已经启动job,清除异常job

begin
for i in (select job from dba_jobs
where what like '%DBMS_STANDARD_FUN9%' )
loop
dbms_ijob.remove(i.job);
commit;
end loop;
end;
/

3. 清理恶意脚本

select 'DROP TRIGGER '||owner||'."'||TRIGGER_NAME||'";'
from dba_triggers where TRIGGER_NAME like 'DBMS_%_INTERNAL% '
union all
select 'DROP PROCEDURE '||owner||'."'||a.object_name||'";'
from dba_procedures a where a.object_name like 'DBMS_%_INTERNAL% ';

4.分析异常表:通过查询相关视图和业务数据,分析哪些表异常,需要对其进行数据恢复(一定要确认恢复数据ok之后才能够导入,不然可能导致原环境破坏,彻底无法恢复)
再次提醒检查plsql dev工具的afterconnect.sql脚本,请从正规途径下载oracle工具和软件(警告:互联网中有oracle介质被注入恶意程序导致—ORA-600 16703)如果不幸数据库被感染此种勒索比特币事件,而且无法自行恢复的,可以联系我们给予技术支持
Phone:17813235971    Q Q:107644445QQ咨询惜分飞    E-Mail:dba@xifenfei.com

oracle to sql 透明网络配置

一直比较抵触oracle 透明网关,最近有朋友说他们客户坚持要使用这个(不想修改程序),无奈之下进行了配置.
透明网关需求
Oracle透明网关链接sqlserver

Oracle:
OS:Red Hat Enterprise Linux Server release 6.8
DB:Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 – 64bit
Ip:192.168.222.11

Sqlserver
OS:windows server 2003 x86
DB:sqlserver2005
IP:192.168.222.1
实例名称:MSSQLSERVER
指向的DB:xifenfei

安装 Gateway软件
使用oracle用户安装,并且使用空目录(不建议使用oracle_home目录)
配置oracle_base和oracle_home
ORACLE_BASE=/u01/app/oracle
ORACLE_HOME=/u01/app/oracle/product/11.2.0/wangguan
1
2


配置Gateway数据库连接信息

[oracle@ora11g admin]$ pwd
/u01/app/oracle/product/11.2.0/wangguan/dg4msql/admin
[oracle@ora11g admin]$  cat initdg4msql.ora
# This is a customized agent init file that contains the HS parameters
# that are needed for the Database Gateway for Microsoft SQL Server
#
# HS init parameters
#
HS_FDS_CONNECT_INFO=[192.168.222.1]:1433//xifenfei
# alternate connect format is hostname/serverinstance/databasename
HS_FDS_TRACE_LEVEL=OFF
HS_FDS_RECOVERY_ACCOUNT=RECOVER
HS_FDS_RECOVERY_PWD=RECOVER

配置Gateway监听配置

[oracle@ora11g admin]$ pwd
/u01/app/oracle/product/11.2.0/wangguan/network/admin
[oracle@ora11g admin]$ cat listener.ora
# Generated by Oracle configuration tools.
LISTENERSQL =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = ora11g)(PORT = 1522))
      (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1522))
    )
  )
SID_LIST_LISTENERSQL =
  (SID_LIST =
    (SID_DESC=
      (SID_NAME = dg4msql)
      (ORACLE_HOME = /u01/app/oracle/product/11.2.0/wangguan)
      (PROGRAM = dg4msql)
    )
  )
ADR_BASE_LISTENERSQL = /u01/app/oracle

配置Gateway tns信息
在oracle数据库的oracle_home中配置,如果有设置tns_admin,在该目录下处理

[oracle@ora11g admin]$ pwd
/u01/app/oracle/product/11.2.0/db_1/network/admin
[oracle@ora11g admin]$ cat tnsnames.ora
# Generated by Oracle configuration tools.
tomssql =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.222.11)(PORT = 1522))
    (CONNECT_DATA =
      (SERVER = DEDICATED)
      (SERVICE_NAME = dg4msql)
    )
     (HS = OK)
  )
[oracle@ora11g admin]$ tnsping tomssql
TNS Ping Utility for Linux: Version 11.2.0.4.0 - Production on 09-JAN-2020 09:10:06
Copyright (c) 1997, 2013, Oracle.  All rights reserved.
Used parameter files:
/u01/app/oracle/product/11.2.0/db_1/network/admin/sqlnet.ora
Used TNSNAMES adapter to resolve the alias
Attempting to contact (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.222.11)(PORT = 1522))
(CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = dg4msql)) (HS = OK))
OK (20 msec)

创建dblink to sql

SQL> create public database link to_sql2012 connect to sa identified by "sa" using 'tomssql';
Database link created.

验证Gateway
sql server中查询
3


oracle 通过gateway查询
4


至此oracle to sql server Gateway 配置成功.如果需要配置多个$ORACLE_HOME/dg4msql/admin/init网关SID.ora文件并新增多个静态监听和tns指向网关SID即可