[AusNOG] Really embarrassing question. [SEC=Unofficial]

[Joseph Goldman]

and then nightly `rsync /var/mail /some/other/server` :P

On 13/04/16 19:46, Anthony Moore wrote:
> Does another process still have it open?
>
> # lsof | grep poorbastard
> # cat /proc/<pid>/fd/<fd number>
>
> where <pid> is the second column of lsof output, fd is the 4th.
>
> Otherwise, you need to unmount the filesystem ASAP  (or remount read-only) and do a filesystem level recovery.
>
> Anthony
> ________________________________________
> From: AusNOG <ausnog-bounces at lists.ausnog.net> on behalf of Ross Wheeler <ausnog at rossw.net>
> Sent: Wednesday, 13 April 2016 7:31 PM
> To: ausnog at lists.ausnog.net
> Subject: [AusNOG] Really embarrassing question.
>
> <fx: hangs head in shame>
>
> In a distracted moment, I've clobbered a file.
>
>     > /var/mail/poorbastard
>
> instead of
>
>     > /var/mail/otherbastard
>
>
> It's a FreeBSD system.
> The file in question doesn't have a sufficiently recent backup I can
> restore.
> Blame, "should have" and similarly derogatory comments to /dev/null
> thanks.
>
> I was told "testdisk" might recover the file, but it didn't.
> The file isn't worth $thousands+ and the downtime required for major
> sector-by-sector recovery attempts, but if anyone has workable
> suggestions, I'd be keen to hear them.
>
> (So just to be clear, it's not simply a "deleted file" I want to recover.
> Upside, the file will be plain text, and "most of it" is still useful,
> unlike some others where anything less than 100% is the same as nothing).
>
> Thanks,
> R.
> _______________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog
> _______________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog