使用bbed不仅仅可以找回已经delete的数据还可以恢复update的数据，当然过程要比恢复delete的数据复杂一些。

实验过程如下：

SYS@ORCL>create table bbed_test(x int,y varchar2(20));

Table created.

SYS@ORCL>insert into bbed_test values(1,'BADLY9');

1 row created.

SYS@ORCL>insert into bbed_test values(2,'JP');

1 row created.

SYS@ORCL>commit;

Commit complete.

SYS@ORCL>select rowid, dbms_rowid.rowid_relative_fno(rowid)rel_fno,

2 dbms_rowid.rowid_block_number(rowid)blockno,

3 dbms_rowid.rowid_row_number(rowid) rowno

4 from bbed_test;

ROWID REL_FNO BLOCKNO ROWNO

------------------ ---------- ---------- ----------

AAAM0WAABAAAOuCAAA 1 60290 0

AAAM0WAABAAAOuCAAB 1 60290 1

SYS@ORCL>update bbed_test set y='JP1' where x=1;

1 row updated.

SYS@ORCL>commit;

Commit complete.

SYS@ORCL>select dump(1,'16') from dual;

DUMP(1,'16')

-----------------

Typ=2 Len=2: c1,2

SYS@ORCL>select dump(2,'16') from dual;

DUMP(2,'16')

-----------------

Typ=2 Len=2: c1,3

SYS@ORCL>select dump('BADLY9',16) from dual;

DUMP('BADLY9',16)

-------------------------------

Typ=96 Len=6: 42,41,44,4c,59,39

SYS@ORCL>select dump('JP1','16') from dual;

DUMP('JP1','16')

----------------------

Typ=96 Len=3: 4a,50,31

SYS@ORCL>select * from bbed_test;

X Y

---------- --------------------

1 JP1

2 JP

下面使用bbed进行查看

BBED> set dba 1,60290

DBA 0x0040eb82 (4254594 1,60290)

BBED> map

File: /u01/app/oracle/oradata/ORCL/system01.dbf (1)

Block: 60290 Dba:0x0040eb82

------------------------------------------------------------

KTB Data Block (Table/Cluster)

struct kcbh, 20 bytes @0?

struct ktbbh, 72 bytes @20?

struct kdbh, 14 bytes @92?

struct kdbt[1], 4 bytes @106?

sb2 kdbr[2] @110?

ub1 freespace[8042] @114?

ub1 rowdata[32] @8156?

ub4 tailchk @8188?

BBED> p kdbr

sb2 kdbr[0] @110 8064

sb2 kdbr[1] @112 8074?

BBED> p *kdbr[1]

rowdata[10]

-----------

ub1 rowdata[10] @8166 0x2c

8166-8074=92

BBED> x /rnc

rowdata[10] @8166

-----------

flag@8166: 0x2c (KDRHFL, KDRHFF, KDRHFH)

lock@8167: 0x00

cols@8168: 2?

col 0[2] @8169: 2

col 1[2] @8172: JP?

BBED> p *kdbr[0]

rowdata[0]

----------

ub1 rowdata[0] @8156 0x2c?

BBED> x /rnc

rowdata[0] @8156

----------

flag@8156: 0x2c (KDRHFL, KDRHFF, KDRHFH)

lock@8157: 0x02

cols@8158: 2?

col 0[2] @8159: 1

col 1[3] @8162: JP1?

BBED> set count 64

COUNT 64?

BBED> d /v

File: /u01/app/oracle/oradata/ORCL/system01.dbf (1)

Block: 60290 Offsets: 8156 to 8191 Dba:0x0040eb82

-------------------------------------------------------

2c020202 c102034a 50312c00 0202c103 l ,...?..JP1,...?.

024a502c 000202c1 02064241 444c5939 l .JP,...?..BADLY9

0206d5a3 l ..??

<16 bytes per line>?

使用bbed找回历史值

通过dump出来的值，推算出来第一条记录的起点02c1 02064241 444c5939

在这个值的基础上offset-3得到offset的值为8175

8175-92=8083 1f93

BBED> p kdbr

sb2 kdbr[0] @110 8064

sb2 kdbr[1] @112 8074?

--修改row directory指针位置

BBED> m /x 931f

File: /u01/app/oracle/oradata/ORCL/system01.dbf (1)

Block: 60290 Offsets: 110 to 173 Dba:0x0040eb82

------------------------------------------------------------------------

931f8a1f 02000000 02000200 791f321f 831e481e 00000000 00000000 00000000

00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000?

<32 bytes per line>?

BBED> p kdbr

sb2 kdbr[0] @110 8083

sb2 kdbr[1] @112 8074?

BBED> sum apply

Check value for File 1, Block 60290:

current = 0x3e20, required = 0x3e20?

BBED> verify

DBVERIFY - Verification starting