Re: [GENERAL] Recovery damaged dump file

On 03/10/2017 01:25 AM, mac pack wrote:

2017-03-10 5:11 GMT+00:00 Adrian Klaver <adrian.klaver@aklaver.com
<mailto:adrian.klaver@aklaver.com>>:

    On 03/09/2017 09:09 PM, Adrian Klaver wrote:

        On 03/09/2017 03:55 AM, mac pack wrote:

            Hi.

            My PostgreSQL server was affect by a Ransomware virus. I'm
            trying to
            restore the database from a dump file made by pg_dump in
            custom format
            (-F c option), but the dump file seems to be damaged in the
            first's 1000
            lines.

            Opening the file with vi shows ^@^@^@^@^@^@^@^@^@^@^
            followed by part of
            the databse schema and the a lote of lines with binary
            characters that i
            think is the table's data.


        The custom format is a binary format so non text characters would be
        expected.

        Did you try to restore using the file, before doing the below?


yes


        If there was an error when you did that and if so what was it?


    Should be:

    Was there an error when you did that and if so what was it?


pg_restore db.bckup > out.sql
pg_restore: [archiver] input file does not appear to be a valid archive

Opening the original damaged file in vi with :%!xxd it show's:

So something zeroed out the beginning of the file.

I know you said:

pg_restore  -s db.backup > out.sql

works. Does the opposite work also?:

pg_restore  -a db.backup > out.sql

I would say start with Michael's suggestion of working through object by object.

You mentioned another dev database, how close is that to the content of the damaged database?

0003ff80: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0003ff90: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0003ffa0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0003ffb0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0003ffc0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0003ffd0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0003ffe0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0003fff0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00040000: 3331 3820 2020 2020 2020 2020 2020 202d  318            -
00040010: 272c 206e 756c 6c29 3b0d 0a69 6e73 6572  ', null);..inser
00040020: 7420 696e 746f 206d 6f72 6164 6173 6374  t into moradasct
00040030: 7428 6964 5f64 6973 7463 6f6e 632c 206c  t(id_distconc, l
00040040: 6f63 616c 6964 6164 652c 2061 7272 7561  ocalidade, arrua
00040050: 6d65 6e74 6f2c 2074 726f 636f 2c20 6c69  mento, troco, li
00040060: 6d5f 696e 6665 7269 6f72 5f70 6f72 7461  m_inferior_porta
00040070: 2c20 636c 6965 6e74 652c 2063 6f64 6967  , cliente, codig
00040080: 6f5f 706f 7374 616c 2c20 6c69 6d5f 7375  o_postal, lim_su
00040090: 7065 7269 6f72 2920 7661 6c75 6573 2028  perior) values (






            I tried to replace those first lines with lines from other
            dev database
            and i can run pg_restore but at some point throws error.

            pg_restore  db.backup > out.sql

            pg_restore: [custom archiver] unrecognized data block type
            (0) while
            searching archive

            The follow commands works fine:
            pg_restore  -s db.backup > out.sql
            pg_restore -l db.backup

            Do you think it's possible to recover the dump file, is
            there any method
            or tool to recover dump files?


            Thanks.
            Mário





    --
    Adrian Klaver

    adrian.klaver@aklaver.com <mailto:adrian.klaver@aklaver.com>

--
Adrian Klaver
adrian.klaver@aklaver.com