Ext3 users - Mar 2009 - undeletable files - even after fsck.ext3 -f (long)

Hi,

  sorry for the long mail but I'm really in an emergency and have no enought
  specific knowledge to understand what is happening.

situation
========
  I have a samba server (debian etch, kernel 2.6.26) on which a user
  'silvia' has a profile that got corrupted in some way (see below). I
  wanted to get rid of the files but there is no way to delete them:

      srv-: # ll
      total 16
      ?---------  ? ?      ?                ?                ? compreg.dat
      drwxrwsr-x+ 2 silvia amministrazione  6 2007-06-08 18:33 extensions
      ?---------  ? ?      ?                ?                ? extensions.rdf
      drwxrwsr-x+ 3 silvia amministrazione 46 2007-10-31 16:16 ImapMail
      -rwx------  1 mauro  amministrazione 62 2007-03-28 15:53 impab.mab
      drwxrwsr-x+ 3 silvia amministrazione 26 2007-06-08 18:34 Mail
        
      srv-: # rm compreg.dat 
      rm: cannot remove `compreg.dat': No such file or directory
      
  I hava already used fsck (clean filesystem) and fsck -f (FILESYSTEM
  MODIFIED, but I think is just becouse it added lost+found)

  if I look for all files I obtain:

      # find ! -user silvia -ls
      find: ./guhdjtzd.default/extensions.rdf: No such file or directory
      find: ./guhdjtzd.default/extensions.rdf: No such file or directory
      53348196    4 -rwx------   1 mauro amministrazione  62 Mar 28  2007
./guhdjtzd.default/impab.mab
      find: ./guhdjtzd.default/compreg.dat: No such file or directory
      find: ./guhdjtzd.default/compreg.dat: No such file or directory
      
copying files
=============
  I also tried to copy using 'cp -a dir_with_corrupetd_file /tmp' and I
  ended up 

     1. filling the / (It was way too big -- / is a diffrent filesystem/disk)
     2. a directory that cannot be deleted:

	srv-fossati:/tmp/pappo# rm -Rf M
	rm: cannot chdir from `.' to `M': Exec format error


orign of these file
===================
  Just in case it is of any help to diagnose the problem, the corrupted file
  have a very strange origin: they where found there with ownership
  'postfix' in a folder of the profile of 'silvia' in a
directory of
  Thunderbird settings: at that moment (apart from the ownership that was
  not easy to explain) I could read the file (a normal mail message). What
  was strance was that I could see 2 occurrencies of that file using 'ls
-l'
  so that I thought there was some unprintable char in the name and decided
  to delete it. After the attempt to delete it I obtained the situation
  described above.


What now?
========
   I'm really lost. I don't have *any* idea of how to repare the
filesystem
   or what can be the cause: virus? memory corruption on server (I tested it
   10 day ago due to some strange freeze, but resulted no error in 24 hours
   of memtest), controller (/ and /home are on different controllers).

   I'd be really thankfull for any possible hint

   Thanks in advance
   sandro

       

-- 
Sandro Dentella  *:-)
http://sqlkit.argolinux.org        SQLkit home page - PyGTK/python/sqlalchemy

On Wed, Mar 18, 2009 at 12:03:51PM +0100, Alessandro Dentella
wrote:
> Hi,
> 
>   sorry for the long mail but I'm really in an emergency and have no
enought
>   specific knowledge to understand what is happening.
I'm sorry for this mail, but I made a big mistake. I checked one filesystem
when the file was on another filesystem... checking the correct filesystem
(/home that was an xfs) fixed the problem.

Still there are many things that are not at all clear in the genesis of the
problem, and the fact that copying the directory the corruption of the
filesystem propagated. Should anybody have any idea I'd be pleased to read
it.


sandro