Am Donnerstag 16 Juli 2020 schrieb fraser kendall:
> I have just done the stupidest thing. I was freeing up (rm -rf)
> space on what I thought was a storage directory (/srv), but I have
> now just discovered that it contained a critical qemu image. The
> image is a W7 VM and is still running; it appears unaffected. The
> /srv partition is the largest on this machine and the testdisk
> recovery image of this partition (~170G) is too large to fit anywhere
> on the hard drive.
>
> This machine is mission critical. I cannot take it offline for
> another 6 hours, and I'll need to have it back up asap, (within an
> hour) so I need to plan my attack.
>
> So some very naive questions.
>
> Best option: 1) can I retrieve the deleted qcow image from a running
> instance of that image?

Disclaimer: I'm not a professional or tech expert of any kind. However,
what comes to mind is, that a file deleted but still used by a process,
is not yet deleted (fs synced) by the kernel. If this is true in your
case, leaving the process running which uses that images, saves it from
being deleted as long as the process runs. Is the file still there in
the filesystem?

So, maybe you can just copy the qcow image. If this copy will work
remains an open question.

HTH

Kind regards,
Stefan