1、创建实验表t1。
create table t1(a varchar2(10),b varchar2(10));
insert into t1 values('aaaaa','aaaaa');
commit;
2、查询系统scn号（生产环境可以通过logminer获得scn）。
select name,current_scn from v$database;
3、t1表数据被篡改。
update t1 set a='*****',b='*****';
commit;
4、关闭数据库将数据库启动到mount。
shutdown immediate;
startup mount;
5、执行基于scn号的数据恢复。
run{
set until scn 2939682;
restore database;
recover database;
alter database open resetlogs;
}
输出日志：
[oracle@db udump]$ rman target /
Recovery Manager: Release 10.2.0.4.0 - Production on Mon Dec 11 16:35:51 2017
Copyright (c) 1982, 2007, Oracle. All rights reserved.
connected to target database: DB1 (DBID=1525588825, not open)
RMAN> run{
2> set until scn 2939682;
3> restore database;
4> recover database;
5> alter database open resetlogs;
6> }
executing command: SET until clause
using target database control file instead of recovery catalog
Starting restore at 11-DEC-17
allocated channel: ORA_DISK_1
channel ORA_DISK_1: sid=155 devtype=DISK
channel ORA_DISK_1: starting datafile backupset restore
channel ORA_DISK_1: specifying datafile(s) to restore from backup set
restoring datafile 00001 to /oracle/app/oradata/db1/system01.dbf
restoring datafile 00002 to /oracle/app/oradata/db1/undotbs01.dbf
restoring datafile 00003 to /oracle/app/oradata/db1/sysaux01.dbf
restoring datafile 00004 to /oracle/app/oradata/db1/users01.dbf
channel ORA_DISK_1: reading from backup piece /oracle/app/flash_recovery_area/DB1/backupset/2017_12_11/o1_mf_nnndf_TAG20171211T161907_f2whvvyz_.bkp
channel ORA_DISK_1: restored backup piece 1
piece handle=/oracle/app/flash_recovery_area/DB1/backupset/2017_12_11/o1_mf_nnndf_TAG20171211T161907_f2whvvyz_.bkp tag=TAG20171211T161907
channel ORA_DISK_1: restore complete, elapsed time: 00:02:25
Finished restore at 11-DEC-17
Starting recover at 11-DEC-17
using channel ORA_DISK_1
starting media recovery
media recovery complete, elapsed time: 00:00:01
Finished recover at 11-DEC-17
database opened
RMAN>
6、查看被篡改的数据是否恢复正常。
select * from t1;
