标签云
asm恢复 bbed bootstrap$ dul In Memory kcbzib_kcrsds_1 kccpb_sanity_check_2 kfed MySQL恢复 ORA-00312 ORA-00607 ORA-00704 ORA-01110 ORA-01555 ORA-01578 ORA-08103 ORA-600 2131 ORA-600 2662 ORA-600 2663 ORA-600 3020 ORA-600 4000 ORA-600 4137 ORA-600 4193 ORA-600 4194 ORA-600 16703 ORA-600 kcbzib_kcrsds_1 ORA-600 KCLCHKBLK_4 ORA-15042 ORA-15196 ORACLE 12C oracle dul ORACLE PATCH Oracle Recovery Tools oracle加密恢复 oracle勒索 oracle勒索恢复 oracle异常恢复 Oracle 恢复 ORACLE恢复 ORACLE数据库恢复 oracle 比特币 OSD-04016 YOUR FILES ARE ENCRYPTED 勒索恢复 比特币加密文章分类
- Others (2)
- 中间件 (2)
- WebLogic (2)
- 操作系统 (102)
- 数据库 (1,670)
- DB2 (22)
- MySQL (73)
- Oracle (1,532)
- Data Guard (52)
- EXADATA (8)
- GoldenGate (21)
- ORA-xxxxx (159)
- ORACLE 12C (72)
- ORACLE 18C (6)
- ORACLE 19C (14)
- ORACLE 21C (3)
- Oracle 23ai (7)
- Oracle ASM (65)
- Oracle Bug (8)
- Oracle RAC (52)
- Oracle 安全 (6)
- Oracle 开发 (28)
- Oracle 监听 (28)
- Oracle备份恢复 (560)
- Oracle安装升级 (91)
- Oracle性能优化 (62)
- 专题索引 (5)
- 勒索恢复 (78)
- PostgreSQL (18)
- PostgreSQL恢复 (6)
- SQL Server (27)
- SQL Server恢复 (8)
- TimesTen (7)
- 达梦数据库 (2)
- 生活娱乐 (2)
- 至理名言 (11)
- 虚拟化 (2)
- VMware (2)
- 软件开发 (37)
- Asp.Net (9)
- JavaScript (12)
- PHP (2)
- 小工具 (20)
-
最近发表
- ORA-600 krse_arc_complete.4
- Oracle 19c 202410补丁(RUs+OJVM)
- ntfs MFT损坏(ntfs文件系统故障)导致oracle异常恢复
- .mkp扩展名oracle数据文件加密恢复
- 清空redo,导致ORA-27048: skgfifi: file header information is invalid
- A_H_README_TO_RECOVER勒索恢复
- 通过alert日志分析客户自行对一个数据库恢复的来龙去脉和点评
- ORA-12514: TNS: 监听进程不能解析在连接描述符中给出的SERVICE_NAME
- ORA-01092 ORA-00604 ORA-01558故障处理
- ORA-65088: database open should be retried
- Oracle 19c异常恢复—ORA-01209/ORA-65088
- ORA-600 16703故障再现
- 数据库启动报ORA-27102 OSD-00026 O/S-Error: (OS 1455)
- .[metro777@cock.li].Elbie勒索病毒加密数据库恢复
- 应用连接错误,初始化mysql数据库恢复
- RAC默认服务配置优先节点
- Oracle 19c RAC 替换私网操作
- 监听报TNS-12541 TNS-12560 TNS-00511错误
- drop tablespace xxx including contents恢复
- Linux 8 修改网卡名称
分类目录归档:Oracle
.mkp扩展名oracle数据文件加密恢复
又有客户的oracle数据库文件被勒索,扩展名被加密为:.[tsai.shen@mailfence.com].mkp
对应的+README-WARNING+.txt文件内容类似:
::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay us. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailboxes: tsai.shen@mailfence.com or nicetomeetyou@onionmail.org .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don抰 want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.
通过分析确认该文件就是头部32个block被破坏,因为oracle数据库中前面32个block是不含业务数据(主要是文件头和位图信息),通过自研的Oracle数据文件加密勒索恢复工具对其进行修复
重建ctl之后,open数据库查询用户创建时间证明库是直接open成功的
根据客户需求截图业务数据
类似勒索病毒预防建议:
1. 教育和培训:提高用户的网络安全意识非常重要。通过定期的网络安全培训和教育,向用户传达有关勒索病毒及其传播方式的知识,让他们能够警惕潜在的威胁,并学会如何正确应对可疑的电子邮件、链接和附件。
2. 更新和维护:及时更新操作系统、应用程序和安全软件,以修补已知的漏洞,并确保系统能够及时获取最新的安全补丁。此外,定期进行系统维护和检查,确保系统的安全配置和设置。
3. 备份数据:定期备份重要的数据和文件,并将备份存储在安全的离线或云存储中。确保备份是完整的、可靠的,并且能够及时恢复,以便在发生勒索病毒感染或其他数据丢失事件时能够快速恢复数据。
4. 网络安全工具:使用可信赖的网络安全工具,包括防病毒软件、防火墙、入侵检测系统等,以提高系统的安全性和防护能力。定期对系统进行全面的安全扫描和检测,及时发现并清除潜在的威胁。
5. 访问控制:实施严格的访问控制措施,限制用户对系统和文件的访问权限,避免使用管理员权限进行日常操作,以减少恶意软件感染的风险。此外,定期审查和更新访问控制策略,确保系统安全性得到有效维护。
6. 应急响应计划:制定和实施应急响应计划,明确团队成员的责任和任务,建立应对勒索病毒和其他安全事件的应急响应流程,以最大程度地减少损失并快速恢复业务正常运营。
如果此类的数据库(oracle,mysql,sql server)等被加密,需要专业恢复技术支持,请联系我们:
电话/微信:17813235971 Q Q:107644445 E-Mail:dba@xifenfei.com
清空redo,导致ORA-27048: skgfifi: file header information is invalid
客户由于空间不足,使用> redo命令清空了oracle的redo文件
数据库挂掉之后,启动报错
Fri Oct 04 10:32:57 2024 alter database open Beginning crash recovery of 1 threads parallel recovery started with 31 processes Started redo scan Errors in file /home/oracle/oracle/diag/rdbms/xifenfei/xifenfei/trace/xifenfei_ora_24876.trc: ORA-00313: open failed for members of log group 3 of thread 1 ORA-00312: online log 3 thread 1: '/u01/app/oracle/oradata/xifenfei/redo03.log' ORA-27048: skgfifi: file header information is invalid Additional information: 13 Aborting crash recovery due to error 313 Errors in file /home/oracle/oracle/diag/rdbms/xifenfei/xifenfei/trace/xifenfei_ora_24876.trc: ORA-00313: open failed for members of log group 3 of thread 1 ORA-00312: online log 3 thread 1: '/u01/app/oracle/oradata/xifenfei/redo03.log' ORA-27048: skgfifi: file header information is invalid Additional information: 13 Errors in file /home/oracle/oracle/diag/rdbms/xifenfei/xifenfei/trace/xifenfei_ora_24876.trc: ORA-00313: open failed for members of log group 3 of thread 1 ORA-00312: online log 3 thread 1: '/u01/app/oracle/oradata/xifenfei/redo03.log' ORA-27048: skgfifi: file header information is invalid Additional information: 13 ORA-313 signalled during: alter database open... Fri Oct 04 10:32:58 2024 Errors in file /home/oracle/oracle/diag/rdbms/xifenfei/xifenfei/trace/xifenfei_m000_29646.trc: ORA-00313: open failed for members of log group 1 of thread 1 ORA-00312: online log 1 thread 1: '/u01/app/oracle/oradata/xifenfei/redo01.log' ORA-27047: unable to read the header block of file Linux-x86_64 Error: 25: Inappropriate ioctl for device Additional information: 1 Errors in file /home/oracle/oracle/diag/rdbms/xifenfei/xifenfei/trace/xifenfei_m000_29646.trc: ORA-00313: open failed for members of log group 2 of thread 1 ORA-00312: online log 2 thread 1: '/u01/app/oracle/oradata/xifenfei/redo02.log' ORA-27047: unable to read the header block of file Linux-x86_64 Error: 25: Inappropriate ioctl for device Additional information: 1 Errors in file /home/oracle/oracle/diag/rdbms/xifenfei/xifenfei/trace/xifenfei_m000_29646.trc: ORA-00313: open failed for members of log group 3 of thread 1 ORA-00312: online log 3 thread 1: '/u01/app/oracle/oradata/xifenfei/redo03.log' ORA-27048: skgfifi: file header information is invalid Additional information: 11 Checker run found 6 new persistent data failures Fri Oct 04 10:47:32 2024 db_recovery_file_dest_size of 4182 MB is 0.00% used. This is a user-specified limit on the amount of space that will be used by this database for recovery-related files, and does not reflect the amount of space available in the underlying filesystem or ASM diskgroup.
这种情况下,所有redo全部被清空(包含current,active的redo),只能强制拉库,运气不错,拉库成功.
Sun Oct 06 10:09:01 2024 alter database open resetlogs RESETLOGS is being done without consistancy checks. This may result in a corrupted database. The database should be recreated. RESETLOGS after incomplete recovery UNTIL CHANGE 25668466513 Resetting resetlogs activation ID 4222555315 (0xfbaf14b3) Sun Oct 06 10:09:10 2024 Setting recovery target incarnation to 3 Sun Oct 06 10:09:10 2024 Assigning activation ID 79943739 (0x4c3d83b) Thread 1 opened at log sequence 1 Current log# 1 seq# 1 mem# 0: /u01/app/oracle/oradata/xifenfei/redo01.log Successful open of redo thread 1 MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set Sun Oct 06 10:09:11 2024 SMON: enabling cache recovery Undo initialization finished serial:0 start:70198684 end:70198794 diff:110 (1 seconds) Dictionary check beginning Dictionary check complete Verifying file header compatibility for 11g tablespace encryption.. Verifying 11g file header compatibility for tablespace encryption completed SMON: enabling tx recovery Database Characterset is AL32UTF8 No Resource Manager plan active Sun Oct 06 10:09:12 2024 replication_dependency_tracking turned off (no async multimaster replication found) Starting background process QMNC Sun Oct 06 10:09:13 2024 QMNC started with pid=23, OS id=4328 LOGSTDBY: Validating controlfile with logical metadata LOGSTDBY: Validation complete Sun Oct 06 10:09:16 2024 db_recovery_file_dest_size of 4182 MB is 0.00% used. This is a user-specified limit on the amount of space that will be used by this database for recovery-related files, and does not reflect the amount of space available in the underlying filesystem or ASM diskgroup. Sun Oct 06 10:09:16 2024 Starting background process CJQ0 Sun Oct 06 10:09:16 2024 CJQ0 started with pid=25, OS id=4413 Completed: alter database open resetlogs
通过alert日志分析客户自行对一个数据库恢复的来龙去脉和点评
12.1.0.2数据库由于异常断电,导致无法正常启动,通过alert日志对客户的整个操作过程进行分析(不含我的操作部分)
通过alert日志分析最初故障原因是由于控制文件有坏块导致
Tue Sep 24 11:49:48 2024 alter database open Tue Sep 24 11:49:48 2024 Ping without log force is disabled . Tue Sep 24 11:49:48 2024 Errors in file /u01/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_ora_4715.trc: ORA-01113: file 10 needs media recovery ORA-01110: data file 10: '/u01/app/oracle/oradata/xifenfei.dbf' ORA-1113 signalled during: alter database open... alter database recover datafile '/u01/app/oracle/oradata/xifenfei.dbf'
offline 无法正常recover的数据文件
Tue Sep 24 13:13:30 2024 Media Recovery Complete (orcl) Completed: ALTER DATABASE RECOVER datafile 15 ALTER DATABASE DATAFILE '/u01/app/oracle/oradata/xifenfei.dbf' END BACKUP ORA-1235 signalled during: ALTER DATABASE DATAFILE '/u01/app/oracle/oradata/xifenfei.dbf' END BACKUP... ALTER DATABASE DATAFILE '/u01/app/oracle/oradata/xifenfei.dbf' offline Completed: ALTER DATABASE DATAFILE '/u01/app/oracle/oradata/xifenfei.dbf' offline Tue Sep 24 13:25:16 2024 ALTER DATABASE DATAFILE '/u01/app/oracle/oradata/xff.dbf' offline Completed: ALTER DATABASE DATAFILE '/u01/app/oracle/oradata/xff.dbf' offline
然后尝试打开数据库,遭遇ORA-600 4193错误,没有open成功
Tue Sep 24 13:27:06 2024 Media Recovery Complete (orcl) Completed: ALTER DATABASE RECOVER datafile 13 alter database open Tue Sep 24 13:27:16 2024 Ping without log force is disabled . Tue Sep 24 13:27:16 2024 Beginning crash recovery of 1 threads parallel recovery started with 7 processes Tue Sep 24 13:27:16 2024 Started redo scan Tue Sep 24 13:27:16 2024 Completed redo scan read 67 KB redo, 0 data blocks need recovery Tue Sep 24 13:27:16 2024 Started redo application at Thread 1: logseq 7422, block 2, scn 119284797 Tue Sep 24 13:27:16 2024 Recovery of Online Redo Log: Thread 1 Group 3 Seq 7422 Reading mem 0 Mem# 0: /u01/app/oracle/oradata/orcl/redo03.log Tue Sep 24 13:27:16 2024 Completed redo application of 0.00MB Tue Sep 24 13:27:16 2024 Completed crash recovery at Thread 1: logseq 7422, block 136, scn 119284798 0 data blocks read, 0 data blocks written, 67 redo k-bytes read Initializing SCN for created control file Database SCN compatibility initialized to 3 Starting background process TMON Tue Sep 24 13:27:16 2024 TMON started with pid=32, OS id=10617 Tue Sep 24 13:27:16 2024 Thread 1 advanced to log sequence 7423 (thread open) Thread 1 opened at log sequence 7423 Current log# 1 seq# 7423 mem# 0: /u01/app/oracle/oradata/orcl/redo01.log Successful open of redo thread 1 Tue Sep 24 13:27:16 2024 MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set Tue Sep 24 13:27:16 2024 SMON: enabling cache recovery Tue Sep 24 13:27:20 2024 [10553] Successfully onlined Undo Tablespace 2. Undo initialization finished serial:0 start:6974064 end:6975474 diff:1410 ms (1.4 seconds) Dictionary check beginning Tablespace 'TEMP' #3 found in data dictionary, but not in the controlfile. Adding to controlfile. File #10 is offline, but is part of an online tablespace. data file 10: '/u01/app/oracle/oradata/tbs_data.dbf' File #14 is offline, but is part of an online tablespace. data file 14: '/u01/app/oracle/oradata/corsmf03.dbf' Dictionary check complete Verifying minimum file header compatibility (11g) for tablespace encryption.. Verifying 11g file header compatibility for tablespace encryption completed Tue Sep 24 13:27:21 2024 SMON: enabling tx recovery Tue Sep 24 13:27:21 2024 ********************************************************************* WARNING: The following temporary tablespaces contain no files. This condition can occur when a backup controlfile has been restored. It may be necessary to add files to these tablespaces. That can be done using the SQL statement: ALTER TABLESPACE <tablespace_name> ADD TEMPFILE Alternatively, if these temporary tablespaces are no longer needed, then they can be dropped. Empty temporary tablespace: TEMP ********************************************************************* Updating character set in controlfile to AL32UTF8 Starting background process SMCO Tue Sep 24 13:27:21 2024 SMCO started with pid=34, OS id=10632 Errors in file /u01/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_smon_10523.trc (incident=108129): ORA-00600: internal error code, arguments: [4193], [21368], [21372], [], [], [], [], [], [], [], [], [] Incident details in:/u01/app/oracle/diag/rdbms/orcl/orcl/incident/incdir_108129/orcl_smon_10523_i108129.trc Use ADRCI or Support Workbench to package the incident. See Note 411.1 at My Oracle Support for error and packaging details. ………… Tue Sep 24 13:27:24 2024 Errors in file /u01/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_ora_10553.trc: ORA-00600: internal error code, arguments: [4193], [21652], [21539], [], [] Tue Sep 24 13:27:24 2024 Errors in file /u01/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_ora_10553.trc: ORA-00600: internal error code, arguments: [4193], [21652], [21539], [], [] Error 600 happened during db open, shutting down database USER (ospid: 10553): terminating the instance due to error 600 Tue Sep 24 13:27:25 2024 Instance terminated by USER, pid = 10553 ORA-1092 signalled during: alter database open...
重建了ctl,加入_allow_resetlogs_corruption隐含参数,尝试使用resetlogs方式打开数据库,报ORA-600 2662错误
Tue Sep 24 14:30:22 2024 alter database open RESETLOGS Tue Sep 24 14:32:09 2024 RESETLOGS is being done without consistancy checks. This may result in a corrupted database. The database should be recreated. RESETLOGS after incomplete recovery UNTIL CHANGE 119237645 time Online log /u01/app/oracle/oradata/orcl/redo01.log: Thread 1 Group 1 was previously cleared Online log /u01/app/oracle/oradata/orcl/redo02.log: Thread 1 Group 2 was previously cleared Online log /u01/app/oracle/oradata/orcl/redo03.log: Thread 1 Group 3 was previously cleared Tue Sep 24 14:32:09 2024 Setting recovery target incarnation to 2 Tue Sep 24 14:32:09 2024 Ping without log force is disabled . Initializing SCN for created control file Database SCN compatibility initialized to 3 Tue Sep 24 14:32:09 2024 Warning - High Database SCN: Current SCN value is 119237648, threshold SCN value is 0 If you have not previously reported this warning on this database, please notify Oracle Support so that additional diagnosis can be performed. Starting background process TMON Tue Sep 24 14:32:09 2024 TMON started with pid=25, OS id=15032 Tue Sep 24 14:32:09 2024 Assigning activation ID 1708301307 (0x65d29bfb) Thread 1 opened at log sequence 1 Current log# 1 seq# 1 mem# 0: /u01/app/oracle/oradata/orcl/redo01.log Successful open of redo thread 1 Tue Sep 24 14:32:09 2024 MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set Tue Sep 24 14:32:09 2024 SMON: enabling cache recovery Errors in file /u01/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_ora_14937.trc (incident=122458): ORA-00600: internal error code, arguments: [2662], [0], [119484861], [0], [119484868], [16777344]…… Incident details in: /u01/app/oracle/diag/rdbms/orcl/orcl/incident/incdir_122458/orcl_ora_14937_i122458.trc Errors in file /u01/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_ora_14937.trc (incident=122459): ……………… Tue Sep 24 14:32:16 2024 Errors in file /u01/app/oracle/diag/rdbms/orcl/orcl/incident/incdir_124802/orcl_ora_14937_i124802.trc: ORA-00603: ORACLE server session terminated by fatal error ORA-00600: internal error code, arguments: [2662], [0], [119484866], [0], [119484868], [16777344]…… ORA-00600: internal error code, arguments: [2662], [0], [119484865], [0], [119484868], [16777344]…… ORA-01092: ORACLE instance terminated. Disconnection forced ORA-00600: internal error code, arguments: [2662], [0], [119484861], [0], [119484868], [16777344]……
客户的自行恢复到此为止,没有成功,这里客户的恢复没有犯原则性错误(破坏文件的resetlogs 信息),同时也没有解决两个ORA-600错误
1. 在offline部分文件的情况下,打开数据库(没有使用resetlogs,避免了进一步破坏offline文件的resetlogs 信息),但是数据库报ORA-600 4193错误没有打开库成功
2. 后面强制拉库之前重建了ctl文件,避免了offline数据文件在resetlogs之后导致文件头resetlogs 信息和其他文件不一致的可能(因为重建ctl,offline的文件自动onlinne)
3. 最初offline数据文件,启动库报ORA-600 4193故障没有解决,这个故障一般是undo异常导致,这个故障大概率在后面强制拉库open过程中还可能遇到
4. 强制拉库过程中遭遇ORA-600 2662问题,需要修改scn,如果这个问题不解决,数据库无法open成功