Re: [GENERAL] Recovery damaged dump file

On 03/10/2017 01:25 AM, mac pack wrote:
>
> 2017-03-10 5:11 GMT+00:00 Adrian Klaver <adrian.klaver@aklaver.com
> <mailto:adrian.klaver@aklaver.com>>:
>
>     On 03/09/2017 09:09 PM, Adrian Klaver wrote:
>
>         On 03/09/2017 03:55 AM, mac pack wrote:
>
>             Hi.
>
>             My PostgreSQL server was affect by a Ransomware virus. I'm
>             trying to
>             restore the database from a dump file made by pg_dump in
>             custom format
>             (-F c option), but the dump file seems to be damaged in the
>             first's 1000
>             lines.
>
>             Opening the file with vi shows ^@^@^@^@^@^@^@^@^@^@^
>             followed by part of
>             the databse schema and the a lote of lines with binary
>             characters that i
>             think is the table's data.
>
>
>         The custom format is a binary format so non text characters would be
>         expected.
>
>         Did you try to restore using the file, before doing the below?
>
>
> yes
>
>
>         If there was an error when you did that and if so what was it?
>
>
>     Should be:
>
>     Was there an error when you did that and if so what was it?
>
>
> pg_restore db.bckup > out.sql
> pg_restore: [archiver] input file does not appear to be a valid archive
>
> Opening the original damaged file in vi with :%!xxd it show's:

So something zeroed out the beginning of the file.

I know you said:

pg_restore  -s db.backup > out.sql

works. Does the opposite work also?:

pg_restore  -a db.backup > out.sql

I would say start with Michael's suggestion of working through object by
object.

You mentioned another dev database, how close is that to the content of
the damaged database?


>
> 0003ff80: 0000 0000 0000 0000 0000 0000 0000 0000  ................
> 0003ff90: 0000 0000 0000 0000 0000 0000 0000 0000  ................
> 0003ffa0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
> 0003ffb0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
> 0003ffc0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
> 0003ffd0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
> 0003ffe0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
> 0003fff0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
> 00040000: 3331 3820 2020 2020 2020 2020 2020 202d  318            -
> 00040010: 272c 206e 756c 6c29 3b0d 0a69 6e73 6572  ', null);..inser
> 00040020: 7420 696e 746f 206d 6f72 6164 6173 6374  t into moradasct
> 00040030: 7428 6964 5f64 6973 7463 6f6e 632c 206c  t(id_distconc, l
> 00040040: 6f63 616c 6964 6164 652c 2061 7272 7561  ocalidade, arrua
> 00040050: 6d65 6e74 6f2c 2074 726f 636f 2c20 6c69  mento, troco, li
> 00040060: 6d5f 696e 6665 7269 6f72 5f70 6f72 7461  m_inferior_porta
> 00040070: 2c20 636c 6965 6e74 652c 2063 6f64 6967  , cliente, codig
> 00040080: 6f5f 706f 7374 616c 2c20 6c69 6d5f 7375  o_postal, lim_su
> 00040090: 7065 7269 6f72 2920 7661 6c75 6573 2028  perior) values (
>
>
>
>
>
>
>             I tried to replace those first lines with lines from other
>             dev database
>             and i can run pg_restore but at some point throws error.
>
>             pg_restore  db.backup > out.sql
>
>             pg_restore: [custom archiver] unrecognized data block type
>             (0) while
>             searching archive
>
>             The follow commands works fine:
>             pg_restore  -s db.backup > out.sql
>             pg_restore -l db.backup
>
>             Do you think it's possible to recover the dump file, is
>             there any method
>             or tool to recover dump files?
>
>
>             Thanks.
>             Mário
>
>
>
>
>
>     --
>     Adrian Klaver
>     adrian.klaver@aklaver.com <mailto:adrian.klaver@aklaver.com>
>
>


--
Adrian Klaver
adrian.klaver@aklaver.com