Recover deleted file on ext3

[Oracle@goolen ~]$ Sqlplus/as SYSDBA
Sql*plus:release 10.2.0.1.0-production on Tue Dec 31 20:05:37 2013
Copyright (c) 1982, 2005, Oracle. All rights reserved.
Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0-production
With the partitioning, OLAP and Data Mining options
Sql> select Open_mode from V$database;
Open_mode
--------------------
READ WRITE
Sql> select name from V$datafile;
NAME
--------------------------------------------------------------------------------
/opt/oradata/goolen/system01.dbf
/opt/oradata/goolen/undotbs01.dbf
/opt/oradata/goolen/sysaux01.dbf
/opt/oradata/goolen/user01.dbf
+++delete One of DataFile

Sql>! Rm-rf/opt/oradata/goolen/user01.dbf

+++once the database is closed,the handle of the file was disappears
Sql> Shut Abort

ORACLE instance shut down.

+++we can use Ext3grep to restore the file
+++scan file ' s inode and restore
+++scan deleted file from second Inode
[Root@goolen ~]# Df-h
Filesystem Size used Avail use% mounted on
/dev/sda2 23G 8.0G 14G 39%/
/DEV/SDA1 99M 12M 83M 12%/boot
Tmpfs 506M 0 506M 0%/dev/shm

/DEV/SDB1 9.2G 812M 8.0G 10%/opt/oradata

[Root@goolen ~]# ext3grep/dev/sdb1--ls--inode 2
Running Ext3grep version 0.10.2
Warning:ext3_feature_incompat_recover is set. This either means, your partition are still mounted, and/or the file system is in a unclean state.
Number of groups:75
Loading Group metadata ... done
Minimum/maximum Journal block:1116/35028
Loading journal descriptors ... sorting ... done
The oldest inode block, still in the journal, appears to being from 2687232 = Sun Feb 1 10:27:12 1970
Journal transaction 76309 wraps around, some data blocks might has been lost of this transaction.
Number of descriptors in journal:21855; Min/max sequence numbers:76087/86999
Inode is allocated
Loading sdb1.ext3grep.stage2 ... done
The first block of the directory is 1110.
Inode 2 is Directory "".
Directory Block 1110:
.--File type in Dir_entry (r=regular file, D=directory, L=symlink)
| .--d:deleted; r:reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 D 2 drwxr-xr-x.
1 2 d 2 drwxr-xr-x.
2 3 D drwx------Lost+found

3 End D 587521 drwxr-x---goolen

[Root@goolen ~]# ext3grep/dev/sdb1--ls--inode 587521
Running Ext3grep version 0.10.2
Warning:ext3_feature_incompat_recover is set. This either means, your partition are still mounted, and/or the file system is in a unclean state.
Number of groups:75
Minimum/maximum Journal block:1116/35028
Loading journal descriptors ... sorting ... done
The oldest inode block, still in the journal, appears to being from 2687232 = Sun Feb 1 10:27:12 1970
Journal transaction 76309 wraps around, some data blocks might has been lost of this transaction.
Number of descriptors in journal:21855; Min/max sequence numbers:76087/86999
Inode is allocated
Loading sdb1.ext3grep.stage2 ... done
The first block of the directory is 1191936.
Inode 587521 is directory "Goolen".
Directory Block 1191936:
.--File type in Dir_entry (r=regular file, D=directory, L=symlink)
| .--d:deleted; r:reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 D 587521 drwxr-x---.
1 2 d 2 drwxr-xr-x.
2 3 R 587522 rrw-r-----control01.ctl
3 4 R 587523 rrw-r-----control02.ctl
4 5 R 587524 rrw-r-----control03.ctl
5 6 R 587525 rrw-r-----redo01.log
6 7 R 587526 rrw-r-----redo02.log
7 8 R 587527 rrw-r-----redo03.log
8 9 R 587528 rrw-r-----system01.dbf
9 R 587529 rrw-r-----undotbs01.dbf
Ten-one R 587530 rrw-r-----sysaux01.dbf
One end R 587531 rrw-r-----temp01.dbf

End R 587532 D 1388489259 Tue Dec 19:27:39 rrw-r-----user01.dbf

[Root@goolen ~]#
[root@goolen]# ext3grep/dev/sdb1--restore-file goolen/user01.dbf
Running Ext3grep version 0.10.2
Warning:ext3_feature_incompat_recover is set. This either means, your partition are still mounted, and/or the file system is in a unclean state.
Number of groups:75
Minimum/maximum Journal block:1116/35028
Loading journal descriptors ... sorting ... done
The oldest inode, block, still in the journal, appears to was from 1388358146 = Mon Dec 30 07:02:26 2013
Journal transaction 76309 wraps around, some data blocks might has been lost of this transaction.
Number of descriptors in journal:21846; Min/max sequence numbers:75894/86813
Writing Output to directory restored_files/
Finding all blocks this might be directories.
D:block containing directory start, D:block containing more directory entries.
Each plus represents a directory start, references the same inode as a directory start that we found previously.
Searching Group 0:DDD
Searching Group 1:
Searching Group 2:
Searching Group 3:
Searching Group 4:
Searching Group 5:DD
Searching Group 6:
Searching Group 7:DDD
Searching Group 8:
Searching Group 9:
it to Lost+found instead!
Writing analysis so far to ' sdb1.ext3grep.stage2 '. Delete that file if you want to does this stage again.

Restoring goolen/user01.dbf

+++recovered data is saved in Restored_files
[Root@goolen goolen]# pwd
/root/restored_files/goolen
[Root@goolen goolen]# Ls-l
Total 10264

-rw-r-----1 root root 10493952 Dec 23:05 user01.dbf

+++copy this file to corresponding directory
[Root@goolen goolen]# CP user01.dbf/opt/oradata/goolen/user01.dbf

[Root@goolen goolen]# chown oracle:oinstall/opt/oradata/goolen/user01.dbf

+++recover Database:
sql> recover datafile 4;
Media recovery complete.
sql> ALTER DATABASE open;

Database altered.