Linux环境中文件被删除的恢复，通常有几种情况，如果数据库实例还未停止，那么恢复很easy，如果实例停掉，
那么可能需要借助相关的工具来进行恢复，这里我进行简单的描述。
1. 使用工具进行恢复(ext3grep或者extundelete，e2fsprogs等工具)
我这里使用ext3grep来进行删除文件的恢复，如下是一个例子。
1). 安装rpm包
rpm -ivh ext3grep-0.10.2-1.el4.rf.i386.rpm
2).模拟数据文件被删除的恢复
SQL> !rm -rf /home/ora10g/oradata/roger/roger01.dbf
SQL> shutdown abort;
ORACLE instance shut down.
SQL>
3) 扫描文件inode并restore
开始恢复被删掉的文件：
ext3grep /dev/sda3 --restore-file ora10g/oradata/roger/roger01.dbf
注意这里的格式，后面的路径不能加/home。跟前面的Inode 1783429 is directory "ora10g/oradata/roger". 保持一致。
或者
ext3grep /dev/sda3 --restore-inode 1784045
或者恢复整个目录
ext3grep /home/store/file --restore-all
如下是我的操作过程：
恢复出来的文件，会存放在如下地方：
4). 恢复完成之后并move，将文件属主改掉，最后进行recover
或者使用lsof命令进行查看，然后进行copy：
直接copy 相关文件即可，该操作更为简单：
总的来说，对于文件从操作系统级别删掉的情况，如果inode在未被覆盖之前，都是可以恢复，一旦覆盖就难以恢复了，
所以我们建议，一旦有文件被删掉，那么建议将该文件系统umount掉，以免信息被覆盖。
那么可能需要借助相关的工具来进行恢复，这里我进行简单的描述。
1. 使用工具进行恢复(ext3grep或者extundelete，e2fsprogs等工具)
我这里使用ext3grep来进行删除文件的恢复，如下是一个例子。
1). 安装rpm包
rpm -ivh ext3grep-0.10.2-1.el4.rf.i386.rpm
2).模拟数据文件被删除的恢复
SQL> !rm -rf /home/ora10g/oradata/roger/roger01.dbf
SQL> shutdown abort;
ORACLE instance shut down.
SQL>
3) 扫描文件inode并restore
[root@killdb ~]# ext3grep /dev/sda3 --ls --inode 2
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted,
and/or the file system is in an unclean state.
Number of groups: 201
Loading group metadata... done
Minimum / maximum journal block: 1546 / 9748
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 121640448 = Thu Nov 8 13:00:48 1973
Journal transaction 1459878 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 6294; min / max sequence numbers: 1458017 / 1460214
Inode is Allocated
Finding all blocks that might be directories.
D: block containing directory start, d: block containing more directory entries.
Each plus represents a directory start that references the same inode as a directory start that we found previously.
Searching group 0: DDddddddddddddddddddddddddddddDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD.......DDDDDDDDDDDDDDDDDDDDdd
Searching group 1: ddDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD.........DDddDDDDDDDDDDDdd
Searching group 2: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDddddD.....DDDDDD
Searching group 3:
Searching group 4: D
。。。。。。。。。
。。。。。。。。。
Adding extended directory block(s) for directory "ora9/product/9.2/sysman/admin".
Writing analysis so far to 'sda3.ext3grep.stage2'. Delete that file if you want to do this stage again.
The first block of the directory is 1540.
Inode 2 is directory "".
Directory block 1540:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 2 drwxr-xr-x .
1 2 d 2 drwxr-xr-x ..
2 3 d 11 drwx------ lost+found
3 4 d 65409 drwx------ roger
4 5 d 866670 drwxr-xr-x hadoop
5 6 d 1438977 drwxrwxr-x ora10g
6 7 d 3172289 drwx------ ora9
7 8 d 1308161 drwxr-xr-x hbase
8 9 d 2534746 drwxr-xr-x mongodb
9 10 d 1733317 drwxrwxr-x sybase
10 11 d 3106916 drwxr-xr-x puppet
11 12 d 3155939 drwxrwxr-x ggs
12 end d 965021 drwxr-xr-x bak
[root@killdb ~]#
[root@killdb ~]# ext3grep /dev/sda3 --ls --inode 1438977
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the
file system is in an unclean state.
Number of groups: 201
Minimum / maximum journal block: 1546 / 9748
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1376229179 = Sun Aug 11 06:52:59 2013
Journal transaction 1459878 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 6293; min / max sequence numbers: 1458318 / 1460214
Inode is Allocated
Loading sda3.ext3grep.stage2................................................................................. done
The first block of the directory is 2906112.
Inode 1438977 is directory "ora10g".
Directory block 2906112:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 1438977 drwxrwxr-x .
1 2 d 2 drwxr-xr-x ..
2 3 r 1439480 rrwxrwxr-x .bash_profile
3 4 r 1438979 rrwxrwxr-x .bash_logout
4 5 r 1438980 rrwxrwxr-x .canna
5 6 r 1438981 rrwxrwxr-x .gtkrc
6 7 r 1438982 rrwxrwxr-x .emacs
7 8 r 1438983 rrwxrwxr-x .bashrc
8 9 r 1438978 rrwxrwxr-x .bash_history
9 10 d 1441395 drwxrwxr-x oraInventory
10 11 d 1441408 drwxrwxr-x product
11 12 r 1439414 rrw-r--r-- log.bbd
12 13 r 1439581 rrw-r--r-- listfile.txt
13 14 d 1471685 drwxrwxr-x archivelog
14 15 d 1783420 drwxrwxr-x admin
15 16 d 1783428 drwxrwxr-x oradata
16 17 r 1439579 rrwxrwxr-x par.bbed
17 18 r 1439418 rrwxrwxr-x exp.log
18 19 r 1439545 rrw-r--r-- par.1
19 20 d 1471689 drwxrwxr-x logs
20 21 d 1504385 drwxrwxr-x core_397796
21 22 r 1439420 rrwxrwxr-x dbv.log
22 23 r 1439415 rrwxrwxr-x odu_308_linux_x86.tar
23 24 d 1455329 drwxrwxr-x odu
24 25 d 1488036 drwxr-xr-x backup
25 26 r 1439422 rrwxrwxr-x stackx
26 27 d 1717028 drwxrwxr-x odu_test
27 28 r 1439410 rrwxrwxr-x core_397796.tar
28 29 d 1717038 drwxrwxr-x pw_cracker
29 30 r 1439421 rrwxrwxr-x stackx1_2.tar
30 31 r 1439424 rrwxrwxr-x README.txt
31 32 r 1439425 rrwxrwxr-x readme.htm
32 33 r 1439426 rrwxrwxr-x core_397796.txt
33 34 r 1439432 rrw-r--r-- sql_hash.sql
34 35 r 1439434 rrwxrwxr-x 7232.out
35 36 r 1439430 rrwxrwxr-x 1
36 37 r 1439431 rrwxrwxr-x kill_spid.sh
37 38 d 1439428 drwxrwxr-x demo
38 39 r 1439527 rrw-r--r-- test.sh.log
39 40 r 1439523 rrw-r--r-- spawrrac.sql
40 41 r 1439433 rrwxrwxr-x 19623.out
41 42 r 1439435 rrwxrwxr-x sndb3_diag_275164.trc
42 43 r 1439436 rrwxrwxr-x ass109.awk
43 44 r 1439437 rrwxrwxr-x sndb3_diag_275164.trc.out
44 45 r 1439439 rrwxrwxr-x a.txt
45 46 r 1439569 rrwxrwxr-x 1.txt
46 47 r 1439440 rrwxrwxr-x free_tab_block.sql
47 48 d 1439485 drwxr-xr-x dul
48 49 r 1439465 rrwxrwxr-x sqlldr.ctl
49 50 r 1439487 rrw-r--r-- a.out
50 51 r 2763489 rrwxrwxr-x locks.lis
51 52 r 2763490 rrwxrwxr-x heap_analyze.txt
52 53 r 2763494 rrwxrwxr-x heap_analyze.sql
53 54 r 2763492 rrwxrwxr-x roger_ora_11076.trc
54 55 r 2763493 rrwxrwxr-x heapdump_analyze
55 56 r 527701 rrwxrwxr-x delete.out
56 57 r 2763495 rrwxrwxr-x heapanalyze.sh
57 58 r 1783457 rrwxrwxr-x delete.sh
58 59 r 527920 rrwxrwxr-x cpu.lst
59 60 r 1783567 rrwxrwxr-x a.sh
60 61 r 527921 rrwxrwxr-x cpu_stats.lst
61 62 r 527922 rrwxrwxr-x sqlhc.sql
62 63 r 527923 rrwxrwxr-x create.sql
63 64 r 527924 rrwxrwxr-x sqlhc.log
64 65 r 527925 rrwxrwxr-x sqlhc_roger_killdb_10.2.0.5.0_96g93hntrzjtr_20120213055519.html
65 66 r 527926 rrwxrwxr-x sqlt.zip
66 67 d 1439443 drwxrwxr-x sqlt
67 68 r 527928 rrwxrwxr-x a.trc
68 69 r 527929 rrwxrwxr-x bug.sql
69 70 r 527927 rrwxrwxr-x crmsiebel_ora_22610144.trc
70 71 r 527930 rrwxrwxr-x b.trc
71 72 r 527932 rrwxrwxr-x awk_10046.awk
72 73 r 527931 rrwxrwxr-x 13982_trc.trc
73 74 r 1439476 rrwxrwxr-x pfile.ora
74 75 d 1504388 drwxrwxr-x doc
75 76 r 1439461 rrwxrwx--- sqlnet.log
76 77 r 1439462 rrwxrwxr-x drop_index_trace.log
77 78 r 1439444 rrwxrwxr-x awrinfo.txt
78 79 d 1504389 drwxrwxr-x logminer
79 80 r 1439464 rrwxrwxr-x 20149.trc
80 81 r 1439460 rrwxrwxr-x sqlldr.log
81 82 r 1439466 rrwxrwxr-x sqlldr.bad
82 83 r 1439472 rrwxrwxr-x sqlldr2.ctl
83 84 r 1978612 rrwxrwxr-x debug.sh
84 85 r 1439467 rrwxrwxr-x sqlldr2.log
85 86 r 1439469 rrwxrwxr-x block_6.dd
86 87 r 1439459 rrwxrwxr-x Undohealth.out
87 88 r 1439471 rrwxrwxr-x undopressure.out
88 89 r 1439474 rrwxrwxr-x undousage.out
89 90 r 1439475 rrwxrwxr-x check_scn.sql
90 91 r 1439477 rrwxrwxr-x chain.sql
91 92 d 1439473 drwxrwxr-x tmp
92 93 d 1504391 drwxr-xr-x nbu
93 94 r 1439478 rrwxrwxr-x chouqu.sql
94 95 r 1439417 rrwxrwxr-x bifile.bbd
95 97 r 1439481 rrwxrwxr-x a.sql
97 98 r 1439499 rrw-r--r-- a.log
98 99 d 1520737 drwx------ .ssh
99 100 r 1439482 rrwxrwxr-x dd.dbf
100 101 r 1439531 rrwxrwxr-x test.sh
101 102 r 1978613 rrwxrwxr-x dtraceio.d
102 103 d 1488033 drwxr-xr-x tools
103 104 d 1439419 drwxr-xr-x scripts
104 105 r 1439503 rrwxr-xr-x listfile.txt.bak
105 106 d 2779847 drwxr-xr-x arch
106 107 r 1439442 rrw-r--r-- control.txt
107 108 d 1488037 drwxr-xr-x flashback
108 109 r 1439534 rrw-r--r-- ass1033.awk
109 110 d 1684260 drwxr-xr-x archivelog1
110 111 r 1439514 rrw-r--r-- odu_415_linux_x86.tar.gz
111 112 r 1439484 rrwxrwxr-x orion_linux_x86
112 113 d 1684273 drwxr-xr-x tmp_area
113 114 r 1439554 rrwxr-xr-x tmp.txt
114 115 r 1439553 rrwxr-xr-x par.tmp
115 116 r 1439542 rrw-r--r-- a.dmp
116 117 r 1784202 rrw-r--r-- awrrpt_1_1258_1259.html
117 118 r 1439536 rrw-r--r-- cncgu21_l028_32519.trc
118 119 r 1439537 rrw-r--r-- dstarget_ora_562140.trc
119 120 r 1439538 rrw-r--r-- zyk_ora_414106.trc
120 121 r 1439540 rrwxrwxr-x strace.sh
121 122 r 1439565 rrw-r--r-- DD-DATAFILE.zip
122 123 r 1439517 rrw-r--r-- test.lun
123 124 r 1439550 rrw-r--r-- DD.zip
124 125 r 1439575 rrw-r--r-- os_header.dd
125 126 r 1439583 rrwxr-xr-x listfile1.txt
126 127 r 1439582 rrwxr-xr-x par.bbed1
127 128 r 1439546 rrw-r--r-- t_logical_corruption.dmp
128 129 r 1439498 rrwxrwxr-x backup_db.log
129 130 r 1439548 rrw-r--r-- c.log
130 131 r 1439551 rrw-r--r-- d.log
131 132 r 1439552 rrw-r--r-- 1.log
132 133 r 1439555 rrw-r--r-- 0417.dd
133 134 r 1439511 rrw-r--r-- aaaa.log
134 135 r 1439512 rrw-r--r-- 11.log
135 136 r 1439378 rrw-r--r-- a14402.trc
136 137 r 1439558 rrw-r--r-- a2.log
137 138 r 1439559 rrw-r--r-- a1.trc
138 139 r 1439429 rrw-r--r-- test_20130604_2228_summary.txt
139 140 r 1439519 rrw-r--r-- test_20130604_2228_mbps.csv
140 141 r 1439520 rrw-r--r-- test_20130604_2228_iops.csv
141 142 r 1439522 rrw-r--r-- test_20130604_2228_lat.csv
142 143 r 1439528 rrw-r--r-- test_20130604_2228_trace.txt
143 144 r 1439377 rrw-r--r-- test_20130604_2249_summary.txt
144 145 r 1439529 rrw-r--r-- test_20130604_2249_mbps.csv
145 146 r 1439532 rrw-r--r-- test_20130604_2249_iops.csv
146 147 r 1439543 rrw-r--r-- test_20130604_2249_lat.csv
147 148 r 1439560 rrw-r--r-- test_20130604_2249_trace.txt
148 149 r 1439562 rrw-r--r-- coe_xfr_sql_profile.log
149 150 r 1439563 rrw-r--r-- coe_xfr_sql_profile.sql
150 151 r 1439566 rrw-r--r-- coe_xfr_sql_profile_50gr3nwzq39nf_684537719.sql
151 153 r 1439564 rrw-r--r-- coe_xfr_sql_profile_50gr3nwzq39nf_684537719.log
153 154 r 1439571 rrw-r--r-- a1.txt
154 155 r 1439567 rrw-r--r-- sql_plan_exchange.sql
155 156 r 1439606 rrwxr-xr-x par.bbed2
156 157 r 1439544 rrw-r--r-- getpid.sql
157 158 r 1439605 rrw-r--r-- a2.txt
158 159 r 1439556 rrw-r--r-- a1.log
159 160 r 1439506 rrw-r--r-- awrrpt_1_33571_33572.html
160 161 r 1439576 rrw-r--r-- getstat_undo.sql
161 162 r 1439573 rrwxrwxr-x listfile.old
162 163 r 1439572 rrw-r--r-- orasrp-linux.zip
163 164 r 1439561 rrw-r--r-- test_undo1_insert.sql
164 165 r 1439570 rrw-r--r-- test_undo1_insert2.sql
165 166 r 1439530 rrw-r--r-- exp_t.dmp
166 end r 1439574 rrw-r--r-- 12560.log
[root@killdb ~]#
[root@killdb ~]# ext3grep /dev/sda3 --ls --inode 1783428
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 201
Minimum / maximum journal block: 1546 / 9748
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1376229179 = Sun Aug 11 06:52:59 2013
Journal transaction 1459878 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 6293; min / max sequence numbers: 1458318 / 1460214
Inode is Allocated
Loading sda3.ext3grep.stage2................................................................................................................ done
The first block of the directory is 3598344.
Inode 1783428 is directory "ora10g/oradata".
Directory block 3598344:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 1783428 drwxrwxr-x .
1 2 d 1438977 drwxrwxr-x ..
2 3 d 1783429 drwxrwxr-x roger
3 4 d 2698081 drwxr-xr-x recover
4 6 d 1896850 drwxr-xr-x aux
5 6 r 1160995 D 1374650893 Wed Jul 24 00:28:13 2013 rrw-r----- system01.dbf
6 end r 1160993 rrw-r--r-- awrrpt_1_944_945.html
7 8 r 1063076 D 1373425824 Tue Jul 9 20:10:24 2013 rrw-r----- a_data_D-ROGER_I-2466925865_TS-ROGER_FNO-2_0cod7kbr.bak
8 10 r 1063077 D 1373425828 Tue Jul 9 20:10:28 2013 rrw-r----- a_data_D-ROGER_I-2466925865_TS-SYSTEM_FNO-1_0dod7kgc.bak
9 10 r 1063078 D 1373425827 Tue Jul 9 20:10:27 2013 rrw-r----- a_data_D-ROGER_I-2466925865_TS-SYSAUX_FNO-3_0eod7khp.bak
10 end r 1063079 D 1373425830 Tue Jul 9 20:10:30 2013 rrw-r----- a_data_D-ROGER_I-2466925865_TS-USERS_FNO-4_0fod7kj7.bak
11 end r 1063080 D 1373425829 Tue Jul 9 20:10:29 2013 rrw-r----- a_data_D-ROGER_I-2466925865_TS-UNDOTBS2_FNO-6_0god7kk0.bak
12 end r 1063081 D 1373425824 Tue Jul 9 20:10:24 2013 rrw-r----- a_data_D-ROGER_I-2466925865_TS-SQLT_FNO-8_0hod7kkf.bak
13 end r 1063082 D 1373425819 Tue Jul 9 20:10:19 2013 rrw-r----- a_cf_D-ROGER_id-2466925865_0iod7kkm.bak
14 end r 1063083 D 1373425819 Tue Jul 9 20:10:19 2013 rrw-r----- a_0jod7kkp_1_1.bak
[root@killdb /]# ext3grep /dev/sda3 --ls --inode 1783429
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 201
Minimum / maximum journal block: 1546 / 9748
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1376231625 = Sun Aug 11 07:33:45 2013
Journal transaction 1459878 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 6901; min / max sequence numbers: 1458725 / 1460308
Inode is Allocated
Loading sda3.ext3grep.stage2................................................................................................................ done
The first block of the directory is 3598345.
Inode 1783429 is directory "ora10g/oradata/roger".
Directory block 3598345:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 1783429 drwxrwxr-x .
1 2 d 1783428 drwxrwxr-x ..
2 3 r 1783455 rrw-r----- control01.ctl
3 4 r 1783456 rrw-r----- control02.ctl
4 5 r 1783458 rrw-r----- control03.ctl
5 6 r 1783465 rrw-r----- system01.dbf
6 8 r 1783466 rrw-r----- sysaux01.dbf
7 8 r 1784045 D 1376286019 Sun Aug 11 22:40:19 2013 rrw-r----- roger01.dbf
8 9 r 1783470 rrw-r----- undotbs01.dbf
9 10 r 1783500 rrw-r----- users01.dbf
10 11 r 1783898 rrw-r----- redo01.log
11 12 r 1783899 rrw-r----- redo02.log
12 13 r 1783900 rrw-r----- redo03.log
13 14 r 1783903 rrw-r----- temp01.dbf
14 end r 1783992 rrw-r----- system02.dbf
15 16 r 1785770 D 1374650901 Wed Jul 24 00:28:21 2013 rrw-r----- redo02.log
16 end r 1079300 D 1374650901 Wed Jul 24 00:28:21 2013 rrw-r----- redo04.log
17 end r 1079301 D 1374650901 Wed Jul 24 00:28:21 2013 rrw-r--r-- dd.undo
18 end r 1079233 D 1374650919 Wed Jul 24 00:28:39 2013 rrw-r----- temp02.dbf
开始恢复被删掉的文件：
ext3grep /dev/sda3 --restore-file ora10g/oradata/roger/roger01.dbf
注意这里的格式，后面的路径不能加/home。跟前面的Inode 1783429 is directory "ora10g/oradata/roger". 保持一致。
或者
ext3grep /dev/sda3 --restore-inode 1784045
或者恢复整个目录
ext3grep /home/store/file --restore-all
如下是我的操作过程：
[root@killdb /]# ext3grep /dev/sda3 --restore-file ora10g/oradata/roger/roger01.dbf
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 201
Minimum / maximum journal block: 1546 / 9748
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1376231625 = Sun Aug 11 07:33:45 2013
Journal transaction 1459878 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 6903; min / max sequence numbers: 1458725 / 1460310
Loading sda3.ext3grep.stage2................................................................................................................ done
Restoring ora10g/oradata/roger/roger01.dbf
[root@killdb /]#
恢复出来的文件，会存放在如下地方：
[root@killdb roger]# pwd
/RESTORED_FILES/ora10g/oradata/roger
[root@killdb roger]# ls -ltr
total 205016
-rw-r----- 1 root root 209723392 Aug 11 22:26 roger01.dbf
[root@killdb roger]#
4). 恢复完成之后并move，将文件属主改掉，最后进行recover
[root@killdb roger]# mv roger01.dbf /home/ora10g/oradata/roger/
[root@killdb roger]# cd /home/ora10g/oradata/roger
[root@killdb roger]# chown ora10g:oinstall roger01.dbf
[root@killdb roger]# ls -ltr
total 1165464
-rw-r----- 1 ora10g oinstall 20979712 Aug 11 05:45 temp01.dbf
-rw-r----- 1 ora10g oinstall 5251072 Aug 11 22:26 users01.dbf
-rw-r----- 1 ora10g oinstall 26222592 Aug 11 22:26 undotbs01.dbf
-rw-r----- 1 ora10g oinstall 5251072 Aug 11 22:26 system02.dbf
-rw-r----- 1 ora10g oinstall 471867392 Aug 11 22:26 system01.dbf
-rw-r----- 1 ora10g oinstall 293609472 Aug 11 22:26 sysaux01.dbf
-rw-r----- 1 ora10g oinstall 209723392 Aug 11 22:26 roger01.dbf
-rw-r----- 1 ora10g oinstall 52429312 Aug 11 22:27 redo03.log
-rw-r----- 1 ora10g oinstall 52429312 Aug 11 22:27 redo02.log
-rw-r----- 1 ora10g oinstall 52429312 Aug 11 22:27 redo01.log
-rw-r----- 1 ora10g oinstall 7389184 Aug 11 22:28 control03.ctl
-rw-r----- 1 ora10g oinstall 7389184 Aug 11 22:28 control02.ctl
-rw-r----- 1 ora10g oinstall 7389184 Aug 11 22:28 control01.ctl
[root@killdb roger]#
开始进行recover：
[root@killdb roger]# su - ora10g
[ora10g@killdb ~]$ sqlplus "/as sysdba"
SQL*Plus: Release 10.2.0.5.0 - Production on Sun Aug 11 23:05:01 2013
Copyright (c) 1982, 2010, Oracle. All Rights Reserved.
Connected to an idle instance.
SQL> startup mount
ORACLE instance started.
Total System Global Area 167772160 bytes
Fixed Size 1272600 bytes
Variable Size 75498728 bytes
Database Buffers 88080384 bytes
Redo Buffers 2920448 bytes
Database mounted.
SQL> recover datafile 5;
Media recovery complete.
SQL> alter database open;
Database altered.
SQL>
2. 数据库open的情况下，文件被删除
当数据库未关闭时,数据文件被删除恢复起来还是很容易的,不管是linux还是unix都非常简单,如下是一个例子:
SQL> select open_mode from v$database;
OPEN_MODE
----------
READ WRITE
SQL> set lines 200
SQL> col name for a65
SQL> select file#,name from v$datafile ;
FILE# NAME
---------- -----------------------------------------------------------------
1 /home/ora10g/oradata/roger/system01.dbf
2 /home/ora10g/oradata/roger/undotbs01.dbf
3 /home/ora10g/oradata/roger/sysaux01.dbf
4 /home/ora10g/oradata/roger/users01.dbf
5 /home/ora10g/oradata/roger/roger01.dbf
6 /home/ora10g/oradata/roger/system02.dbf
6 rows selected.
SQL> !rm -rf /home/ora10g/oradata/roger/users01.dbf
SQL>
SQL> !
[ora10g@killdb ~]$ ls -ltr /home/ora10g/oradata/roger
total 1165464
-rw-r----- 1 ora10g oinstall 20979712 Aug 11 05:45 temp01.dbf
-rw-r----- 1 ora10g oinstall 5251072 Aug 11 23:06 system02.dbf
-rw-r----- 1 ora10g oinstall 209723392 Aug 11 23:06 roger01.dbf
-rw-r----- 1 ora10g oinstall 52429312 Aug 11 23:06 redo03.log
-rw-r----- 1 ora10g oinstall 52429312 Aug 11 23:06 redo02.log
-rw-r----- 1 ora10g oinstall 293609472 Aug 11 23:11 sysaux01.dbf
-rw-r----- 1 ora10g oinstall 26222592 Aug 11 23:11 undotbs01.dbf
-rw-r----- 1 ora10g oinstall 471867392 Aug 11 23:11 system01.dbf
-rw-r----- 1 ora10g oinstall 52429312 Aug 11 23:11 redo01.log
-rw-r----- 1 ora10g oinstall 5251072 Aug 11 23:11 users01.dbf
-rw-r----- 1 ora10g oinstall 7389184 Aug 11 23:11 control03.ctl
-rw-r----- 1 ora10g oinstall 7389184 Aug 11 23:11 control02.ctl
-rw-r----- 1 ora10g oinstall 7389184 Aug 11 23:11 control01.ctl
[ora10g@killdb ~]$ exit
exit
+++copy datafile
[ora10g@killdb roger]$ ps -ef|grep dbw
ora10g 7193 1 0 23:05 ? 00:00:00 ora_dbw0_roger
ora10g 7367 5727 0 23:09 pts/3 00:00:00 grep dbw
[ora10g@killdb roger]$ cd /proc/7193
[ora10g@killdb 7193]$ cd fd
[ora10g@killdb fd]$ ls -ltr
total 26
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 0 -> /dev/null
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 7 -> /home/ora10g/product/10.2/dbs/lkinstroger (deleted)
l-wx------ 1 ora10g oinstall 64 Aug 11 23:10 6 -> /home/ora10g/admin/roger/bdump/alert_roger.log
l-wx------ 1 ora10g oinstall 64 Aug 11 23:10 5 -> /home/ora10g/admin/roger/udump/roger_ora_7172.trc
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 4 -> /dev/null
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 3 -> /dev/null
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 2 -> /dev/null
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 1 -> /dev/null
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 9 -> /home/ora10g/product/10.2/dbs/hc_roger.dat
l-wx------ 1 ora10g oinstall 64 Aug 11 23:10 8 -> /home/ora10g/admin/roger/bdump/alert_roger.log
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 25 -> /home/ora10g/product/10.2/rdbms/mesg/oraus.msb
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 24 -> /home/ora10g/oradata/roger/temp01.dbf
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 23 -> /home/ora10g/oradata/roger/system02.dbf
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 22 -> /home/ora10g/oradata/roger/roger01.dbf
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 21 -> /home/ora10g/oradata/roger/users01.dbf
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 20 -> /home/ora10g/oradata/roger/sysaux01.dbf
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 19 -> /home/ora10g/oradata/roger/undotbs01.dbf
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 18 -> /home/ora10g/oradata/roger/system01.dbf
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 17 -> /home/ora10g/oradata/roger/control03.ctl
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 16 -> /home/ora10g/oradata/roger/control02.ctl
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 15 -> /home/ora10g/oradata/roger/control01.ctl
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 14 -> /home/ora10g/product/10.2/dbs/lkROGER
lrwx------ 1 ora10g oinstall 64 Aug 11 23:10 13 -> /home/ora10g/product/10.2/dbs/hc_roger.dat
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 12 -> /home/ora10g/product/10.2/rdbms/mesg/oraus.msb
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 11 -> /dev/zero
lr-x------ 1 ora10g oinstall 64 Aug 11 23:10 10 -> /dev/zero
[ora10g@killdb fd]$ pwd
/proc/7193/fd
[ora10g@killdb fd]$ cp /proc/7193/fd/21 /home/ora10g/oradata/roger/users01.dbf
[ora10g@killdb fd]$
+++++将datafile copy之后,进行recover
SQL> recover datafile 4;
ORA-00283: recovery session canceled due to errors
ORA-01124: cannot recover data file 4 - file is in use or recovery
ORA-01110: data file 4: '/home/ora10g/oradata/roger/users01.dbf'
SQL> shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> startup mount
ORACLE instance started.
Total System Global Area 167772160 bytes
Fixed Size 1272600 bytes
Variable Size 75498728 bytes
Database Buffers 88080384 bytes
Redo Buffers 2920448 bytes
Database mounted.
SQL> recover datafile 4;
Media recovery complete.
SQL> alter database open;
Database altered.
SQL> select file#,name,status from v$datafile;
FILE# NAME STATUS
---------- ----------------------------------------------------------------- -------
1 /home/ora10g/oradata/roger/system01.dbf SYSTEM
2 /home/ora10g/oradata/roger/undotbs01.dbf ONLINE
3 /home/ora10g/oradata/roger/sysaux01.dbf ONLINE
4 /home/ora10g/oradata/roger/users01.dbf ONLINE
5 /home/ora10g/oradata/roger/roger01.dbf ONLINE
6 /home/ora10g/oradata/roger/system02.dbf SYSTEM
6 rows selected.
SQL>
或者使用lsof命令进行查看，然后进行copy：
[ora10g@killdb fd]$ ps -ef|grep dbw|grep -v grep
ora10g 7491 1 0 23:12 ? 00:00:00 ora_dbw0_roger
[ora10g@killdb fd]$ lsof -a -p 7491 | egrep "COMMAND|dbf"
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
oracle 7491 ora10g 18uW REG 8,3 471867392 1783465 /home/ora10g/oradata/roger/system01.dbf
oracle 7491 ora10g 19uW REG 8,3 26222592 1783470 /home/ora10g/oradata/roger/undotbs01.dbf
oracle 7491 ora10g 20uW REG 8,3 293609472 1783466 /home/ora10g/oradata/roger/sysaux01.dbf
oracle 7491 ora10g 21uW REG 8,3 5251072 1784064 /home/ora10g/oradata/roger/users01.dbf
oracle 7491 ora10g 22uW REG 8,3 209723392 1784045 /home/ora10g/oradata/roger/roger01.dbf
oracle 7491 ora10g 23uW REG 8,3 5251072 1783992 /home/ora10g/oradata/roger/system02.dbf
oracle 7491 ora10g 24uW REG 8,3 20979712 1783903 /home/ora10g/oradata/roger/temp01.dbf
[ora10g@killdb fd]$
直接copy 相关文件即可，该操作更为简单：
copy /proc/7491/fd/21 /home/ora10g/oradata/roger/user01.dbf
总的来说，对于文件从操作系统级别删掉的情况，如果inode在未被覆盖之前，都是可以恢复，一旦覆盖就难以恢复了，
所以我们建议，一旦有文件被删掉，那么建议将该文件系统umount掉，以免信息被覆盖。
「喜欢这篇文章，您的关注和赞赏是给作者最好的鼓励」
关注作者
【版权声明】本文为墨天轮用户原创内容，转载时必须标注文章的来源（墨天轮），文章链接，文章作者等基本信息，否则作者和墨天轮有权追究责任。如果您发现墨天轮中有涉嫌抄袭或者侵权的内容，欢迎发送邮件至：contact@modb.pro进行举报，并提供相关证据，一经查实，墨天轮将立刻删除相关内容。
