Turning the output from the dpkg-get command into a shell script seems to be working.
Seems to have worked. Everything is now (allegedly) reinstalled. I should therefore be able to trust my binaries.
I've restored the MySQL database for my CMS (drupal). I'll do the Gallery2 ones in a moment.
I'll verify my qmail (and other) installation by checking hashes against an older backup.
What's not good is that the following...
find . -type f -exec file {} \; | grep RFC\ 822
...is returning a list of files that shouldn't be emails, such as the avatars on my website.
What a mess.
