rollback to archiving checkpoint? Need help!!

[William K. Hardeman]

--On Tuesday, April 05, 2005 5:38 AM +0200 Alex Meier <cornflake4 at gmx.at> 
wrote:

>
> Could there be a way to extract to extract the mail bodies from the
> __db.XXX files (for example by forcing the system into an inconsistent
> state so that cyrus uses its binary checkpoint and archiving files to
> recover) - or are the mail bodies _really_ just stored in the individual
> files (which have been definitely deleted) as Jules Agee pointed out?
>
> What do you think - imagine you are allowed to do anything and not
> restricted to good manners or "clean" procedures. What else could I try?
>

No, no way to recover the mail bodies from the __db log files. They really 
are only for the Berkeley DB-based databases used by your cyrus install for 
'accounting' purposes. Once the individual files containing the mail bodies 
are gone, they're gone.

Your only real hope at this point is if you have backups available, as I 
think Jules pointed out.

As a last ditch effort, if your mail spool isn't a busy file system (like 
that's a real possibility), then you could potentially recover the files by 
one of two methods I can think of. The first is by doing a raw edit of the 
disk, which is something I shudder to even think of trying to do. The 
second is to shut down the email server, unmount the disks/partitions, copy 
the disk(s) to a new (set of) disks, mount the new disk(s) and send the old 
ones to a professional forensic recovery company, which costs. Lots. At 
this point, though, it's quite likely that at least some of the sectors of 
the deleted emails have been overwritten with new emails.

-- 
----------------------------------------------------------------------------
William K. Hardeman
wont-i at wkh.org
http://www.wkh.org

---
Cyrus Home Page: http://asg.web.cmu.edu/cyrus
Cyrus Wiki/FAQ: http://cyruswiki.andrew.cmu.edu
List Archives/Info: http://asg.web.cmu.edu/cyrus/mailing-list.html