Re: Recovery damaged dump file

2017-03-10 14:58 GMT+00:00 Adrian Klaver <adrian(dot)klaver(at)aklaver(dot)com>:

> On 03/10/2017 01:25 AM, mac pack wrote:
>
>>
>> 2017-03-10 5:11 GMT+00:00 Adrian Klaver <adrian(dot)klaver(at)aklaver(dot)com
>> <mailto:adrian(dot)klaver(at)aklaver(dot)com>>:
>>
>>
>> On 03/09/2017 09:09 PM, Adrian Klaver wrote:
>>
>> On 03/09/2017 03:55 AM, mac pack wrote:
>>
>> Hi.
>>
>> My PostgreSQL server was affect by a Ransomware virus. I'm
>> trying to
>> restore the database from a dump file made by pg_dump in
>> custom format
>> (-F c option), but the dump file seems to be damaged in the
>> first's 1000
>> lines.
>>
>> Opening the file with vi shows ^(at)^@^(at)^@^(at)^@^(at)^@^(at)^@^
>> followed by part of
>> the databse schema and the a lote of lines with binary
>> characters that i
>> think is the table's data.
>>
>>
>> The custom format is a binary format so non text characters would
>> be
>> expected.
>>
>> Did you try to restore using the file, before doing the below?
>>
>>
>> yes
>>
>>
>> If there was an error when you did that and if so what was it?
>>
>>
>> Should be:
>>
>> Was there an error when you did that and if so what was it?
>>
>>
>> pg_restore db.bckup > out.sql
>> pg_restore: [archiver] input file does not appear to be a valid archive
>>
>> Opening the original damaged file in vi with :%!xxd it show's:
>>
>
> So something zeroed out the beginning of the file.
>
> I know you said:
>
> pg_restore -s db.backup > out.sql
>
> works. Does the opposite work also?:
>
> pg_restore -a db.backup > out.sql
>

No.
pg_restore: [custom archiver] unrecognized data block type (0) while
searching archive

>
> I would say start with Michael's suggestion of working through object by
> object.
>
>
It gives me the same error, unrecognized data block type (0) while
searching archive

> You mentioned another dev database, how close is that to the content of
> the damaged database?
>

The schema is the same, but the data is different.

Any one knows how pg_dump saves the dump in custom format. What is the
structure of the format, there is any doc about that?

Thanks.

>
>
>
>> 0003ff80: 0000 0000 0000 0000 0000 0000 0000 0000 ................
>> 0003ff90: 0000 0000 0000 0000 0000 0000 0000 0000 ................
>> 0003ffa0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
>> 0003ffb0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
>> 0003ffc0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
>> 0003ffd0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
>> 0003ffe0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
>> 0003fff0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
>> 00040000: 3331 3820 2020 2020 2020 2020 2020 202d 318 -
>> 00040010: 272c 206e 756c 6c29 3b0d 0a69 6e73 6572 ', null);..inser
>> 00040020: 7420 696e 746f 206d 6f72 6164 6173 6374 t into moradasct
>> 00040030: 7428 6964 5f64 6973 7463 6f6e 632c 206c t(id_distconc, l
>> 00040040: 6f63 616c 6964 6164 652c 2061 7272 7561 ocalidade, arrua
>> 00040050: 6d65 6e74 6f2c 2074 726f 636f 2c20 6c69 mento, troco, li
>> 00040060: 6d5f 696e 6665 7269 6f72 5f70 6f72 7461 m_inferior_porta
>> 00040070: 2c20 636c 6965 6e74 652c 2063 6f64 6967 , cliente, codig
>> 00040080: 6f5f 706f 7374 616c 2c20 6c69 6d5f 7375 o_postal, lim_su
>> 00040090: 7065 7269 6f72 2920 7661 6c75 6573 2028 perior) values (
>>
>>
>>
>>
>>
>>
>> I tried to replace those first lines with lines from other
>> dev database
>> and i can run pg_restore but at some point throws error.
>>
>> pg_restore db.backup > out.sql
>>
>> pg_restore: [custom archiver] unrecognized data block type
>> (0) while
>> searching archive
>>
>> The follow commands works fine:
>> pg_restore -s db.backup > out.sql
>> pg_restore -l db.backup
>>
>> Do you think it's possible to recover the dump file, is
>> there any method
>> or tool to recover dump files?
>>
>>
>> Thanks.
>> Mário
>>
>>
>>
>>
>>
>> --
>> Adrian Klaver
>> adrian(dot)klaver(at)aklaver(dot)com <mailto:adrian(dot)klaver(at)aklaver(dot)com>
>>
>>
>>
>
> --
> Adrian Klaver
> adrian(dot)klaver(at)aklaver(dot)com
>