On Thursday 16 July 2020 at 12:35:20, fraser kendall wrote:

> I have just done the stupidest thing. I was freeing up (rm -rf) space
> on what I thought was a storage directory (/srv), but I have now just
> discovered that it contained a critical qemu image. The image is a W7
> VM and is still running; it appears unaffected. The /srv partition
> is the largest on this machine and the testdisk recovery image of this
> partition (~170G) is too large to fit anywhere on the hard drive.
>
> This machine is mission critical. I cannot take it offline for another
> 6 hours, and I'll need to have it back up asap, (within an hour) so I
> need to plan my attack.
>
> So some very naive questions.
>
> Best option: 1) can I retrieve the deleted qcow image from a running
> instance of that image?

This suggestion is a bit of a wild guess and untested, but:

Since you have deleted a file which is still open and in use by qemu, the data
at the inode is unaffected and will remain so until the file gets closed -
therefore do not shut the machine down!

Find the process ID of qemu and then look at /proc/$pid/fd - it should contain
some links to the files in use by the process.

You should be able to find out the inode of the file (maybe from lsof, or
perhaps someone else here has a suggestion) and then use a recovery tool such
as debugfs to create a new hard link to the inode, and then copy the file using
that hard link name to somewhere else.

Once you stop qemu the file will really get deleted and the free space will be
added back to the partition.

See https://unix.stackexchange.com/questions/92816 for more clues.


If you can manage to create a hard link and then rsync the file to another
server, perhaps you can try starting it under qemu before you've stopped the
original one (careful of any network conflicts), just to get some confidence
that the image is good and you can get back to where you need to be, before
shutting down the original.


Good luck :)


Antony.

--
Anyone that's normal doesn't really achieve much.

- Mark Blair, Australian rocket engineer

                                                   Please reply to the list;
                                                         please *don't* CC me.