Re: Recovery damaged dump file

On 03/10/2017 01:25 AM, mac pack wrote:
>
> 2017-03-10 5:11 GMT+00:00 Adrian Klaver <adrian(dot)klaver(at)aklaver(dot)com
> <mailto:adrian(dot)klaver(at)aklaver(dot)com>>:
>
> On 03/09/2017 09:09 PM, Adrian Klaver wrote:
>
> On 03/09/2017 03:55 AM, mac pack wrote:
>
> Hi.
>
> My PostgreSQL server was affect by a Ransomware virus. I'm
> trying to
> restore the database from a dump file made by pg_dump in
> custom format
> (-F c option), but the dump file seems to be damaged in the
> first's 1000
> lines.
>
> Opening the file with vi shows ^(at)^@^(at)^@^(at)^@^(at)^@^(at)^@^
> followed by part of
> the databse schema and the a lote of lines with binary
> characters that i
> think is the table's data.
>
>
> The custom format is a binary format so non text characters would be
> expected.
>
> Did you try to restore using the file, before doing the below?
>
>
> yes
>
>
> If there was an error when you did that and if so what was it?
>
>
> Should be:
>
> Was there an error when you did that and if so what was it?
>
>
> pg_restore db.bckup > out.sql
> pg_restore: [archiver] input file does not appear to be a valid archive
>
> Opening the original damaged file in vi with :%!xxd it show's:

So something zeroed out the beginning of the file.

I know you said:

pg_restore -s db.backup > out.sql

works. Does the opposite work also?:

pg_restore -a db.backup > out.sql

I would say start with Michael's suggestion of working through object by
object.

You mentioned another dev database, how close is that to the content of
the damaged database?

>
> 0003ff80: 0000 0000 0000 0000 0000 0000 0000 0000 ................
> 0003ff90: 0000 0000 0000 0000 0000 0000 0000 0000 ................
> 0003ffa0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
> 0003ffb0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
> 0003ffc0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
> 0003ffd0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
> 0003ffe0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
> 0003fff0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
> 00040000: 3331 3820 2020 2020 2020 2020 2020 202d 318 -
> 00040010: 272c 206e 756c 6c29 3b0d 0a69 6e73 6572 ', null);..inser
> 00040020: 7420 696e 746f 206d 6f72 6164 6173 6374 t into moradasct
> 00040030: 7428 6964 5f64 6973 7463 6f6e 632c 206c t(id_distconc, l
> 00040040: 6f63 616c 6964 6164 652c 2061 7272 7561 ocalidade, arrua
> 00040050: 6d65 6e74 6f2c 2074 726f 636f 2c20 6c69 mento, troco, li
> 00040060: 6d5f 696e 6665 7269 6f72 5f70 6f72 7461 m_inferior_porta
> 00040070: 2c20 636c 6965 6e74 652c 2063 6f64 6967 , cliente, codig
> 00040080: 6f5f 706f 7374 616c 2c20 6c69 6d5f 7375 o_postal, lim_su
> 00040090: 7065 7269 6f72 2920 7661 6c75 6573 2028 perior) values (
>
>
>
>
>
>
> I tried to replace those first lines with lines from other
> dev database
> and i can run pg_restore but at some point throws error.
>
> pg_restore db.backup > out.sql
>
> pg_restore: [custom archiver] unrecognized data block type
> (0) while
> searching archive
>
> The follow commands works fine:
> pg_restore -s db.backup > out.sql
> pg_restore -l db.backup
>
> Do you think it's possible to recover the dump file, is
> there any method
> or tool to recover dump files?
>
>
> Thanks.
> Mário
>
>
>
>
>
> --
> Adrian Klaver
> adrian(dot)klaver(at)aklaver(dot)com <mailto:adrian(dot)klaver(at)aklaver(dot)com>
>
>

--
Adrian Klaver
adrian(dot)klaver(at)aklaver(dot)com