Re: Recovery damaged dump file

2017-03-10 5:11 GMT+00:00 Adrian Klaver <adrian(dot)klaver(at)aklaver(dot)com>:

> On 03/09/2017 09:09 PM, Adrian Klaver wrote:
>
>> On 03/09/2017 03:55 AM, mac pack wrote:
>>
>>> Hi.
>>>
>>> My PostgreSQL server was affect by a Ransomware virus. I'm trying to
>>> restore the database from a dump file made by pg_dump in custom format
>>> (-F c option), but the dump file seems to be damaged in the first's 1000
>>> lines.
>>>
>>> Opening the file with vi shows ^(at)^@^(at)^@^(at)^@^(at)^@^(at)^@^ followed by part of
>>> the databse schema and the a lote of lines with binary characters that i
>>> think is the table's data.
>>>
>>
>> The custom format is a binary format so non text characters would be
>> expected.
>>
>> Did you try to restore using the file, before doing the below?
>>
>>
yes

> If there was an error when you did that and if so what was it?
>>
>
> Should be:
>
> Was there an error when you did that and if so what was it?
>
>
pg_restore db.bckup > out.sql
pg_restore: [archiver] input file does not appear to be a valid archive

Opening the original damaged file in vi with :%!xxd it show's:

0003ff80: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0003ff90: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0003ffa0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0003ffb0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0003ffc0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0003ffd0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0003ffe0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0003fff0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00040000: 3331 3820 2020 2020 2020 2020 2020 202d 318 -
00040010: 272c 206e 756c 6c29 3b0d 0a69 6e73 6572 ', null);..inser
00040020: 7420 696e 746f 206d 6f72 6164 6173 6374 t into moradasct
00040030: 7428 6964 5f64 6973 7463 6f6e 632c 206c t(id_distconc, l
00040040: 6f63 616c 6964 6164 652c 2061 7272 7561 ocalidade, arrua
00040050: 6d65 6e74 6f2c 2074 726f 636f 2c20 6c69 mento, troco, li
00040060: 6d5f 696e 6665 7269 6f72 5f70 6f72 7461 m_inferior_porta
00040070: 2c20 636c 6965 6e74 652c 2063 6f64 6967 , cliente, codig
00040080: 6f5f 706f 7374 616c 2c20 6c69 6d5f 7375 o_postal, lim_su
00040090: 7065 7269 6f72 2920 7661 6c75 6573 2028 perior) values (

>
>>
>>> I tried to replace those first lines with lines from other dev database
>>> and i can run pg_restore but at some point throws error.
>>>
>>> pg_restore db.backup > out.sql
>>>
>>> pg_restore: [custom archiver] unrecognized data block type (0) while
>>> searching archive
>>>
>>> The follow commands works fine:
>>> pg_restore -s db.backup > out.sql
>>> pg_restore -l db.backup
>>>
>>> Do you think it's possible to recover the dump file, is there any method
>>> or tool to recover dump files?
>>>
>>>
>>> Thanks.
>>> Mário
>>>
>>
>>
>>
>
> --
> Adrian Klaver
> adrian(dot)klaver(at)aklaver(dot)com
>