Integrity of Oracle7 recovery on NT !

I have recently been testing recovery scenarios on Oracle 7.3.4 on NT and obtained a rather surprising result. I'd be grateful for comments and advice on wrong assumptions I may be making.

In order to be able to test various combinations of possibilities, I have copied files to disk. These must be considered ultimately as back-ups to and recoveries from tape. For discussions sake, assume the instance is ORCL and that *all* files are in n:\orant\database. (I know, that would be awful for both resilience and performance, but this is only a test!). Assume also I have created two directories off database: pre and post.

Step 1: Add some entries to EMP and commit. Then, shut the database down (including all services) and copy control, log and data files to pre.

Step 2: Start services (and database) and add and commit additional entries to EMP.

Step 3: Shut database and services down again and copy the same files to post.

We now have to "snapshots" of the database: one before the last set of changes (in pre) and one after them (in post).

Step 4: Remove all the backed up files and re-instate those from pre. This should restore the database to before the last set of changes. Start up services and database and query the contents of EMP. As expected, this shows the data that was entered in step 1 but not those added in step 2.

Step 5 (and this is where the fun starts). Shut down services and database. remove only the data datafile and replace it by that in post. This should now mean that the files are inconsistent. Since control files and log files are earlier than the data file, Oracle should object. (I did this to show someone I'm training up how Oracle is protected against data inconsistencies.

Start database (with services) and the database opened without any problems. I was also able to query EMP and the data was there from both step 1 and step 2. This is worrying: what if DEPT was on a different datafile?

Step 6: shut everything down and re-instate the pre datafile. On startup, the database requires media recovery. "recover database" gets us back up and working *with only the step 1 data*

Note that, if I repeat the process but. in step 5, I add a column, then Oracle *does* object as I would expect it to. (It tels me that the Control file is older than the data file.)

Why does Oracle allow me to start up with inconsistent SCNs? (Had I not included Control files and log files, I could have lived with all this because Oracle might have performed an auto-recovery. As it was, the Control files and log files were older than the datafile and knew nothing of the step 2 data.)

Note, in all cases, in order to see any error messages, the startup process was:

a) Start the Oracle service
b) Start the database from Server manager
c) Start the OracleStart service.