[AusNOG] Really embarrassing question. [SEC=Unofficial]

[Anthony Moore]

Does another process still have it open?

# lsof | grep poorbastard
# cat /proc/<pid>/fd/<fd number>

where <pid> is the second column of lsof output, fd is the 4th.

Otherwise, you need to unmount the filesystem ASAP  (or remount read-only) and do a filesystem level recovery.

Anthony
________________________________________
From: AusNOG <ausnog-bounces at lists.ausnog.net> on behalf of Ross Wheeler <ausnog at rossw.net>
Sent: Wednesday, 13 April 2016 7:31 PM
To: ausnog at lists.ausnog.net
Subject: [AusNOG] Really embarrassing question.

<fx: hangs head in shame>

In a distracted moment, I've clobbered a file.

   > /var/mail/poorbastard

instead of

   > /var/mail/otherbastard


It's a FreeBSD system.
The file in question doesn't have a sufficiently recent backup I can
restore.
Blame, "should have" and similarly derogatory comments to /dev/null
thanks.

I was told "testdisk" might recover the file, but it didn't.
The file isn't worth $thousands+ and the downtime required for major
sector-by-sector recovery attempts, but if anyone has workable
suggestions, I'd be keen to hear them.

(So just to be clear, it's not simply a "deleted file" I want to recover.
Upside, the file will be plain text, and "most of it" is still useful,
unlike some others where anything less than 100% is the same as nothing).

Thanks,
R.
_______________________________________________
AusNOG mailing list
AusNOG at lists.ausnog.net
http://lists.ausnog.net/mailman/listinfo/ausnog