1、创建实验表t1。create table t1(a varchar2(10),b varchar2(10));insert into t1 values('aaaaa','aaaaa');commit;
2、查询系统scn号（生产环境可以通过logminer获得scn）。select name,current_scn from v$database;
3、t1表数据被篡改。update t1 set a='*****',b='*****';commit;
4、关闭数据库将数据库启动到mount。shutdown immediate;startup mount;
5、执行基于scn号的数据恢复。run{set until scn 2939682;restore database;recover database;alter database open resetlogs;}输出日志：[oracle@db udump]$ rman target /Recovery Manager: Release 10.2.0.4.0 - Production on Mon Dec 11 16:35:51 2017Copyright (c) 1982, 2007, Oracle. All rights reserved.connected to target database: DB1 (DBID=1525588825, not open)RMAN> run{2> set until scn 2939682;3> restore database;4> recover database;5> alter database open resetlogs;6> }executing command: SET until clauseusing target database control file instead of recovery catalogStarting restore at 11-DEC-17allocated channel: ORA_DISK_1channel ORA_DISK_1: sid=155 devtype=DISKchannel ORA_DISK_1: starting datafile backupset restorechannel ORA_DISK_1: specifying datafile(s) to restore from backup setrestoring datafile 00001 to /oracle/app/oradata/db1/system01.dbfrestoring datafile 00002 to /oracle/app/oradata/db1/undotbs01.dbfrestoring datafile 00003 to /oracle/app/oradata/db1/sysaux01.dbfrestoring datafile 00004 to /oracle/app/oradata/db1/users01.dbfchannel ORA_DISK_1: reading from backup piece /oracle/app/flash_recovery_area/DB1/backupset/2017_12_11/o1_mf_nnndf_TAG20171211T161907_f2whvvyz_.bkpchannel ORA_DISK_1: restored backup piece 1piece handle=/oracle/app/flash_recovery_area/DB1/backupset/2017_12_11/o1_mf_nnndf_TAG20171211T161907_f2whvvyz_.bkp tag=TAG20171211T161907channel ORA_DISK_1: restore complete, elapsed time: 00:02:25Finished restore at 11-DEC-17Starting recover at 11-DEC-17using channel ORA_DISK_1starting media recoverymedia recovery complete, elapsed time: 00:00:01Finished recover at 11-DEC-17database openedRMAN>
6、查看被篡改的数据是否恢复正常。select * from t1;