通过BBED恢复删除的数据

首先创建表以及数据并查出文件id和块number:

SQL> create table yy(id number,name varchar2(20));

Table created.

SQL> insert into yy values(2,‘xmj‘);

1 row created.

SQL> insert into yy values(1,‘xw‘);

1 row created.

SQL> commit;

Commit complete.

SQL> select * from yy;

        ID NAME
---------- --------------------
         2 xmj
         1 xw

SQL> select dbms_rowid.rowid_relative_fno(rowid) rel_fno,dbms_rowid.rowid_block_number(rowid) blockno from yy;  

   REL_FNO    BLOCKNO
---------- ----------
         1      58930
         1      58930

SQL> select * from yy;

        ID NAME
---------- --------------------
         2 xmj
         1 xw

SQL> delete from yy where id = 1
  2  ;

1 row deleted.

SQL> commit;

Commit complete.

SQL> select * from yy;

        ID NAME
---------- --------------------
         2 xmj

下面通过bbed恢复出xw这条数据：

BBED> set dba 1,58930
        DBA             0x0040e632 (4253234 1,58930)

BBED> find /c xw
 File: /u01/app/oracle/oradata/qxptfh01/system01.dbf (1)
 Block: 58930            Offsets: 8176 to 8191           Dba:0x0040e632
------------------------------------------------------------------------
 78772c00 0202c103 03786d6a 0206e66b 

 <32 bytes per line>

BBED> set dba 1,58930 offset 8176
        DBA             0x0040e632 (4253234 1,58930)
        OFFSET          8176

BBED> d /v dba 1,58930 offset 8176
 File: /u01/app/oracle/oradata/qxptfh01/system01.dbf (1)
 Block: 58930   Offsets: 8176 to 8191  Dba:0x0040e632
-------------------------------------------------------
 78772c00 0202c103 03786d6a 0206e66b l xw,......xmj...k

 <16 bytes per line>

BBED> d /v offset 8169
 File: /u01/app/oracle/oradata/qxptfh01/system01.dbf (1)
 Block: 58930   Offsets: 8169 to 8191  Dba:0x0040e632
-------------------------------------------------------
 3c020202 c1020278 772c0002 02c10303 l <......xw,......
 786d6a02 06e66b                     l xmj...k

 <16 bytes per line>

BBED> modify /x 2c
Warning: contents of previous BIFILE will be lost. Proceed? (Y/N) y
 File: /u01/app/oracle/oradata/qxptfh01/system01.dbf (1)
 Block: 58930            Offsets: 8169 to 8191           Dba:0x0040e632
------------------------------------------------------------------------
 2c020202 c1020278 772c0002 02c10303 786d6a02 06e66b 

 <32 bytes per line>

BBED> sum apply
Check value for File 1, Block 58930:
current = 0xe6f8, required = 0xe6f8

其实可以通过p kdbr先查出它的offset，再具体定位：

BBED> set dba 1,58930
        DBA             0x0040e632 (4253234 1,58930)

BBED> p kdbr
sb2 kdbr[0]                                 @110      8086
sb2 kdbr[1]                                 @112      8077

BBED> p *kdbr[0]
rowdata[9]
----------
ub1 rowdata[9]                              @8178     0x2c

BBED> p *kdbr[1]
rowdata[0]
----------
ub1 rowdata[0]                              @8169     0x2c           ---这就是我们删除的数据信息，offset为8169

BBED>

以上恢复操作最好shudown数据库后进行操作：

验证：

SQL> select * from yy;

        ID NAME
---------- --------------------
         2 xmj
         1 xw

说明：

1）如果数据未删除：row flag的值为 32+8+4=44或者0x2c

2）如果数据被删除：row flag的值为 32+16+8+4=60或者0x3c