Sql Server Recovery – Database SOS

sql server drop table recovery

A customer found us. Due to improper operation, the drop table statement that should be executed on the standby database was placed on the production library to execute, resulting in the entire production table being droped.

By letting the customer provide relevant data files for analysis and recovery, the recovery effect is very good because the customer does not perform other operations after deleting the table.

If a sql server database is misused (drop, truncate, delete table, etc.), write operations should be avoided as soon as possible, such as: copying data files offline, stopping all database operations, etc. to prevent overwriting due to further writes, thus Make the recovery effect not good. If there is a recovery need, you can contact us:chf.dba@mail.com

Rezcrypt@cock.li Encrypted Database Recovery

E-mail：chf.dba@gmail.com

Title: Rezcrypt@cock.li Encrypted Database Recovery

Some friends feedback system is encrypted with similar suffix name.Email=[Rezcrypt@cock.li]ID=[EOPw1aiueARdMy4].KRONOS

f:\temp>dir xifenfei_DB*
 驱动器 F 中的卷是 本地硬盘
 卷的序列号是 928E-A028

 f:\temp 的目录

2020-03-04  10:37     4,312,465,408 xifenfei_DB.ldf.Email=[Rezcrypt@cock.li]ID=[EOPw1aiueARdMy4].KRONOS
2020-03-04  10:41     5,445,189,632 xifenfei_DB.mdf.Email=[Rezcrypt@cock.li]ID=[EOPw1aiueARdMy4].KRONOS
               2 个文件  9,757,655,040 字节
               0 个目录 376,749,887,488 可用字节

Analysis determined that the file is partially encrypted

Through the underlying processing, perfect recovery of the data outside the shielded block is achieved

For such file encryption, in principle, we can achieve better recovery at the database (mainly oracle and sql server) levels.

SQL Server MDF file size 0kb Recovery

E-mail：chf.dba@gmail.com

Title: SQL Server MDF file size 0kb Recovery

Previously restored the Oracle database dbf file size became 0kb case ( Oracle data file size is 0kb or file loss recovery ), this time I encountered a customer that the mdf file size of the sql server database became 0kb due to the host restart, and the customer himself deleted it The software cannot be recovered normally, we process it through the underlying block of the disk to achieve most of the data recovery (partial data coverage due to some operations of the customer)
This disk partition has multiple mdf files (multiple sql server libraries)

Discover a large number of blocks of the file that are not covered by the underlying block technology

After the mdf file is restored through the block technology, then the table data is restored.

If you encounter a sql server database that causes the mdf file size to become 0kb for some reason, please protect the site as soon as possible and do not perform any write operations. We can recover it to the maximum extent and minimize your loss
If you need to recover, contact us(E-Mail:chf.dba@gmail.com) to provide professional database recovery services

* ALL YOUR WORK AND PERSONAL FILES HAVE BEEN ENCRYPTED *

E-mail：chf.dba@gmail.com

Title: *** ALL YOUR WORK AND PERSONAL FILES HAVE BEEN ENCRYPTED ***

During a period of recent vacation, I received a lot of win file system encrypted database recovery, mainly focused on virus recovery similar to the following. Through analysis, we can determine that the Oracle and Sql Server databases of this type of encrypted virus can achieve more perfect recovery
1. There is a file under the directory of each file !!! DECRYPT MY FILES !!!. Txt file, the content is:

2. Encrypted file name: add the following.id-3109967046_ [Icanhelp@cock.li].firex3m after the original file name

By analyzing the encrypted oracle and sql databases, we can basically achieve perfect recovery (the application of the recovery result can be run directly)

SQL Server Database Bitcoin Encryption Ransomware Recovery

E-mail：chf.dba@gmail.com

Title: SQL Server Database Bitcoin Encryption Ransomware Recovery

For the Oracle database encrypted by GANDCRAB virus, we can provide a more perfect recovery. “GANDCRAB V5.0.4 Bitcoin encryption oracle database recovery”> GANDCRAB V5.0.4 Bitcoin encryption oracle database recovery and GANDCRAB Upgraded Oracle Recovery , we have done some research on the SQL Server database encrypted by GANDCRAB recently, and now it can be better recovered.
gandcrab5.2-sql-server

And if the cost of finding a hacker to decrypt is $ 10w, the customer cannot accept the cost.The main thing in the system is that the sql server database is encrypted. The customer has a backup of several months ago, but the data is severely lost and cannot bear the relevant losses. Recovery support. After a series of recovery, we can achieve a more perfect recovery of the database
gandcrab5.2-sql-server1

gandcrab5.2-sql-server2

If your sql server database is unfortunately encrypted by Bitcoin, you can contact us at any time to provide database level recovery support
E-Mail:chf.dba@gmail.com

SQL Server truncate table Recovery

E-mail：chf.dba@gmail.com

Title: SQL Server truncate table Recovery

In essence, the truncate operation of sql server is similar to oracle.The actual data is still stored on the disk.The parts that are not covered by the analysis of the underlying layer can still be recovered.Here are some general recovery screenshots, and the original table data. 4605 records

Truncate operation on it

Through recovery, parse out the insert sql statement of the truncate table

After inserting data, verify the effect

At this point, we can implement the recovery support of the sql server database by the truncate table. As long as there is no data to be covered, it can be recovered in theory
When your SQL Server database loses data due to misoperation and cannot be resolved by yourself, please contact us to provide professional SQL Server database recovery technical support
E-Mail:chf.dba@gmail.com

SQL Server delete Recovery

E-mail：chf.dba@gmail.com

Title: SQL Server delete Recovery

The delete operation of the SQL server is actually similar to Oracle in nature. We can recover it in two ways: 1. directly parse the SQL log, 2. directly read the mdf / ndf file to find out the records that are marked for deletion. In the case of a log, the log analysis can more accurately locate the records (because the records that may be found according to the delete mark are not the delete operation), here is a simple recovery process. A SQL server table, the number of records 83 Article

Delete it

Perform recovery analysis, directly generate insert statements, and de-insert the library.

At the same time, we can also generate the corresponding redo / undo related SQL statements as needed.

At this point, we have analyzed that we can recover the lost data of the SQL server delete misoperation.
When your SQL Server database loses data due to misoperation and cannot be resolved by yourself, please contact us to provide professional SQL Server database recovery technical support
E-Mail:chf.dba@gmail.com

SQL Server drop table Recovery

E-mail：chf.dba@gmail.com

Title: SQL Server drop table Recovery

The sql server drop table is essentially the data on the disk.It can still be recovered like Oracle through the underlying technology.

Backup table data for deleting before and after comparison

Delete table data

We restore the data (you can restore the table structure and table data)

Compare data before and after recovery

Through comparison, we found that we achieve perfect recovery of drop table data.
When your SQL Server database loses data due to misoperation and cannot be resolved by yourself, please contact us to provide professional SQL Server database recovery technical support
E-Mail:chf.dba@gmail.com

Category Archives: Sql Server Recovery