Ok, I see you are doing what I would do (write error on copy means rename the temporary). Cool.

I assume you meant "The file is opened for writing, not appending" in your second paragraph, not "The file is >not< opened for writing, not appending". I was thinking about longer lengths, though. That is, if you start writing a longer new file, it can run out of space still. The disk has enough room for original.raw of 28MB + tmpfile.raw of 28.5MB, but not enough room to extend original.raw out to 28.5MB. Of course, that's a problem whether you detect it up front or after copying 28MB of tmpfile.raw to original.raw. Based on what you say, detecting up front means printing an error, detecting in the middle means renaming tmpfile.raw to original.raw. I'm not sure which is better :-)

I appreciate that you've taken the data integrity seriously (much better than I would have expected the "average" developer to do), and you can see I do the same. Image data is very sensitive, as I'm quite certain you are aware.