On 16/07/20 12:35, fraser kendall wrote:
> I have just done the stupidest thing. I was freeing up (rm -rf) space
> on what I thought was a storage directory (/srv), but I have now just
> discovered that it contained a critical qemu image. The image is a W7
> VM and is still running; it appears unaffected. The /srv partition
> is the largest on this machine and the testdisk recovery image of this
> partition (~170G) is too large to fit anywhere on the hard drive.
[cut]
>
> Best option: 1) can I retrieve the deleted qcow image from a running
> instance of that image?


If I understood correctly the image file is still open, so MAYBE there's
an open file descriptor inside /proc/$pid/fd that you can use to create
a copy of the image somewhere else...?