Published on March 25th, 2014 | by NJ Ouchn0
[New Tool] DataWalker for Oracle v1.0 in the wild
DataWalker for Oracle is a data unloader and block examiner tool. It can be used by DBAs to recover data or by forensic examiners to look for evidence after a breach.
Figure 1 – the DataWalker interface
This document describes how to recover data from a given table.
Recovering data using DataWalker
For the purposes of this exercise, we’ll dump a list of object IDs and object names from the SYS.OBJ$ table from the data file that contains the SYSTEM tablespace. To start, click on the “Folder” icon on the toolbar and select the data file. Once selected you’ll be presented with a “Load Options” window:
If you don’t want to examine any data blocks simply select, “No load, just open”. This is the quickest option. Then choose “Data” from the menu and select “Export”. You’ll be presented with the “Export Data” form. This form requires three pieces of information: an export template, an output file and the object ID of the table you wish to dump the data from.
Tool submitted by the respected David Litchfield.