[LUNI] finding out what rm did

[mjinks at sysvi.com]

On Wed, Nov 28, 2001 at 06:51:58PM -0600, Douglas Trainor wrote:
> Or a journaling filesystem!

I think you may misunderstand what journalling filesystems actually do.

They don't let you undo changes to the filesystem which have been allowed
to complete.  Rather, they guarantee that operations which are interrupted
by a crash won't corrupt the filesystem.

-m


> mjinks at sysvi.com wrote:
> 
> > Short, snide answer: Nope.  You're hosed, next time be more careful.
> >
> > Slightly longer answer: You could try some post-disaster forensics,
> > if you have a package management system you could see what's missing, for
> > example 'rpm -Va | grep missing'.  But depending on what all went with the
> > rm, you might not have enough system left to recover with even if you do
> > find which files are missing.
> >
> > This won't do you any good now, but for future incidents you should look
> > at a file integrity checker like tripwire or aide.
> >
> > Good luck,
> > -m
> 
> ______________________________________________________________________
> Linux Users Of Northern Illinois - Technical Discussion 
> luni at luni.org
> http://luni.org/mailman/listinfo/luni