轉載請注明出處：
http://blog.csdn.net/guoyjoe/article/details/30615151
實驗步驟例如以下：
1、創建表guo_test1
gyj@PROD> create table guoyJoe_t1(id int,name varchar2(10));
Table created.
gyj@PROD> insert into guoyJoe_t1 values(1,'guoyJoe');
1 row created.
gyj@PROD> insert into guoyJoe_t1 values(1,'tom');
1 row created.
gyj@PROD> COMMIT;
Commit complete.
2、查出這行記錄的DBA
gyj@PROD> select name,dbms_rowid.rowid_relative_fno(rowid) file#,dbms_rowid.rowid_block_number(rowid) block#,dbms_rowid.rowid_row_number(rowid) row# from guoyJoe_t1;
NAME FILE# BLOCK# ROW#
---------- ---------- ---------- ----------
guoyJoe 5 20877 0
tom 5 20877 1
3、刷數據緩存
gyj@PROD> alter system flush buffer_cache;
System altered.
4、利用BBED找到這行記錄（改動前的值：guoyJoe）
BBED> BBED> set file 5 block 20877
FILE# 5
BLOCK# 20877
--觀察行頭
BBED> p kdbr
sb2 kdbr[0] ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? @118 ? ? ?8074
sb2 kdbr[1] ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? @120 ? ? ?8064
BBED> p *kdbr[0]
rowdata[10]
-----------
ub1 rowdata[10] ? ? ? ? ? ? ? ? ? ? ? ? ? ? @8174 ? ? 0x2c
--觀察事務
BBBED> x /rnc
rowdata[10] ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? @8174 ? ?
-----------
flag@8174: 0x2c (KDRHFL, KDRHFF, KDRHFH)
lock@8175: 0x01
cols@8176: ? ?2
col ? ?0[2] @8177: 1?
col ? ?1[7] @8180: guoyJoe
---觀察空間
BBED> p kdbhavsp
sb2 kdbhavsp ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?@110 ? ? ?8042
BBED> p kdbhtosp
sb2 kdbhtosp ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?@112 ? ? ?8042
5、發生UPDATE語句，把原來的值guoyJoe改動成oracledba
gyj@PROD> update guoyJoe_t1 set name='oracledba' where name='guoyJoe';
1 row updated.
gyj@PROD> commit;
Commit complete
6、刷數據緩存
gyj@PROD> alter system flush buffer_cache;
System altered.
7、利用BBED找到這行被改動后的記錄（改動后的值上：oracledba）
BBED> set file 5 block 20877
FILE# 5
BLOCK# 20877
--觀察行頭
BBED> p kdbr
sb2 kdbr[0] ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? @118 ? ? ?8048
sb2 kdbr[1] ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? @120 ? ? ?8064
BBED> p *kdbr[0]
rowdata[0]
----------
ub1 rowdata[0] ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?@8148 ? ? 0x2c
--觀察事務
BBED> x /rnc
rowdata[0] ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?@8148 ? ?
----------
flag@8148: 0x2c (KDRHFL, KDRHFF, KDRHFH)
lock@8149: 0x01
cols@8150: ? ?2
col ? ?0[2] @8151: 1?
col ? ?1[9] @8154: oracledba
---觀察空間
BBED> p kdbhavsp
sb2 kdbhavsp ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?@110 ? ? ?8040
BBED> p kdbhtosp ?
sb2 kdbhtosp ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?@112 ? ? ?8040
8、對照改動前與改動后的數據
BBED> d /v offset 8174 count 16
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 20877 Offsets: 8174 to 8189 Dba:0x0140518d
-------------------------------------------------------
2c000202 c1020767 756f794a 6f650106 l ,...á..guoyJoe..
BBED> d /v offset 8148 count 16
File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
Block: 20877 Offsets: 8148 to 8163 Dba:0x0140518d
-------------------------------------------------------
2c010202 c102096f 7261636c 65646261 l ,...á..oracledba
9、開始恢復
（1）改動row directory指針位置（@118）
--改動前
BBED> p kdbr
sb2 kdbr[0] ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? @118 ? ? ?8074
--改動后
BBED> p kdbr
sb2 kdbr[0] ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? @118 ? ? ?8048
gyj@PROD> select to_char('8074','xxxxxxxxxxxxxx') from dual;
TO_CHAR('8074',
---------------
? ? ? ? ? ?1f8a
gyj@PROD> select to_char('8048','xxxxxxxxxxxxxx') from dual;
TO_CHAR('8048',
---------------
? ? ? ? ? ?1f70
BBED> d /v offset 118 count 16
?File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
?Block: 20877 ? Offsets: ?118 to ?133 ?Dba:0x0140518d
-------------------------------------------------------
?701f801f 00000000 00000000 00000000 l p...............
BBED> modify /x 8a offset 118
Warning: contents of previous BIFILE will be lost. Proceed? (Y/N) Y
?File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
?Block: 20877 ? ? ? ? ? ?Offsets: ?118 to ?133 ? ? ? ? ? Dba:0x0140518d
------------------------------------------------------------------------
?8a1f801f 00000000 00000000 00000000?
?<32 bytes per line>
BBED> sum apply
Check value for File 5, Block 20877:
current = 0x8a00, required = 0x8a00
BBED> verify
DBVERIFY - Verification starting
FILE = /u01/app/oracle/oradata/PROD/tp01.dbf
BLOCK = 20877
Block Checking: DBA = 20992397, Block Type = KTB-managed data block
data header at 0x7f76ff66e264
kdbchk: xaction header lock count mismatch ?----事務鎖報錯
? ? ? ? trans=1 ilk=1 nlo=0
Block 20877 failed with check code 6108
DBVERIFY - Verification complete
Total Blocks Examined ? ? ? ? : 1
Total Blocks Processed (Data) : 1
Total Blocks Failing ? (Data) : 1
Total Blocks Processed (Index): 0
Total Blocks Failing ? (Index): 0
Total Blocks Empty ? ? ? ? ? ?: 0
Total Blocks Marked Corrupt ? : 0
Total Blocks Influx ? ? ? ? ? : 0
Message 531 not found; ?product=RDBMS; facility=BBED
（2）接下來改動事務鎖
---把更新前值的事務鎖標記從00改為01
BBBED> x /rnc
rowdata[10] ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? @8174 ? ?
-----------
flag@8174: 0x2c (KDRHFL, KDRHFF, KDRHFH)
lock@8175: 0x01
cols@8176: ? ?2
BBED> d /v offset 8175 count 16
?File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
?Block: 20877 ? Offsets: 8175 to 8190 ?Dba:0x0140518d
-------------------------------------------------------
?000202c1 02076775 6f794a6f 6501066f l ...á..guoyJoe..o
BBED> modify /x 01 offset 8175
?File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
?Block: 20861 ? ? ? ? ? ?Offsets: 8175 to 8190 ? ? ? ? ? Dba:0x0140517d
------------------------------------------------------------------------
?010202c1 02076775 6f794a6f 650106ed?
--把更新后值的事務鎖標識01改為00
BBED> x /rnc
rowdata[0] ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?@8148 ? ?
----------
flag@8148: 0x2c (KDRHFL, KDRHFF, KDRHFH)
lock@8149: 0x01
cols@8150: ? ?2
BBED> d /v offset 8149 count 16
?File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
?Block: 20877 ? Offsets: 8149 to 8164 ?Dba:0x0140518d
-------------------------------------------------------
?010202c1 02096f72 61636c65 6462612c l ...á..oracledba,
BBED> modify /x 00 offset 8149
?File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
?Block: 20861 ? ? ? ? ? ?Offsets: 8159 to 8174 ? ? ? ? ? Dba:0x0140517d
------------------------------------------------------------------------
?000202c1 02096f72 61636c65 6462612c?
BBED> sum apply
Check value for File 5, Block 20877:
current = 0x8a00, required = 0x8a00
BBED> verify
DBVERIFY - Verification starting
FILE = /u01/app/oracle/oradata/PROD/tp01.dbf
BLOCK = 20877
Block Checking: DBA = 20992397, Block Type = KTB-managed data block
data header at 0x7cb464
kdbchk: the amount of space used is not equal to block size
? ? ? ? used=46 fsc=0 avsp=8040 dtl=8088?
? ? ---提示數據塊的空間使用不對（dtl-used=kdbhavsp=kdbhtosp）
? ? ? ?8088-46=8042 與 avsp=8040相關2,也就是說我要恢復到8042
? ? ?
?(3)改動空間，把空間改動為6a1f,以dtl-used=kdbhavsp為主
? gyj@PROD> select to_char('8042','xxxxxxxxxxxxxx') from dual;
? ? ? TO_CHAR('8042',
? ? ? ?---------------
? ? ? ? ? ?1f6a
? BBED> modify /x 6a1f ?offset 110
?File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
?Block: 20877 ? ? ? ? ? ?Offsets: ?110 to ?125 ? ? ? ? ? Dba:0x0140518d
------------------------------------------------------------------------
?6a1f681f 00000200 8a1f801f 00000000?
?<32 bytes per line>
BBED> modify /x 6a1f ?offset 112
?File: /u01/app/oracle/oradata/PROD/tp01.dbf (5)
?Block: 20877 ? ? ? ? ? ?Offsets: ?112 to ?127 ? ? ? ? ? Dba:0x0140518d
------------------------------------------------------------------------
?6a1f0000 02008a1f 801f0000 00000000?
?<32 bytes per line>
BBED> sum apply
Check value for File 5, Block 20877:
current = 0x8a00, required = 0x8a00
BBED> verify
DBVERIFY - Verification starting
FILE = /u01/app/oracle/oradata/PROD/tp01.dbf
BLOCK = 20877
DBVERIFY - Verification complete
Total Blocks Examined ? ? ? ? : 1
Total Blocks Processed (Data) : 1
Total Blocks Failing ? (Data) : 0
Total Blocks Processed (Index): 0
Total Blocks Failing ? (Index): 0
Total Blocks Empty ? ? ? ? ? ?: 0
Total Blocks Marked Corrupt ? : 0
Total Blocks Influx ? ? ? ? ? : 0
Message 531 not found; ?product=RDBMS; facility=BBED
10、恢復成功（oracledba--->guoyJoe）
gyj@PROD> alter system flush buffer_cache;
System altered.
gyj@PROD> select name,dbms_rowid.rowid_relative_fno(rowid) file#,dbms_rowid.rowid_block_number(rowid) block#,dbms_rowid.rowid_row_number(rowid) row# from guoyJoe_t1 where id=1;
NAME FILE# BLOCK# ROW#
---------- ---------- ---------- ----------
guoyJoe 5 20877 0
tom 5 20877 1
實際上用BBED恢復UPDATE前的值不難，主要是要了解內部原理和塊格式
總結例如以下：
?（1）改動行頭
?（2）改動事務
?（3）改動空間
更多文章、技術交流、商務合作、聯系博主
微信掃碼或搜索：z360901061
微信掃一掃加我為好友
QQ號聯系： 360901061
您的支持是博主寫作最大的動力，如果您喜歡我的文章，感覺我的文章對您有幫助，請用微信掃描下面二維碼支持博主2元、5元、10元、20元等您想捐的金額吧，狠狠點擊下面給點支持吧，站長非常感激您！手機微信長按不能支付解決辦法：請將微信支付二維碼保存到相冊，切換到微信，然后點擊微信右上角掃一掃功能，選擇支付二維碼完成支付。
【本文對您有幫助就好】元
