fraser kendall wrote on 16/7/20 8:35 pm:
> I have just done the stupidest thing. I was freeing up (rm -rf) space
> on what I thought was a storage directory (/srv), but I have now just
> discovered that it contained a critical qemu image. The image is a W7
> VM and is still running; it appears unaffected. The /srv partition
> is the largest on this machine and the testdisk recovery image of this
> partition (~170G) is too large to fit anywhere on the hard drive.
>
> This machine is mission critical. I cannot take it offline for another
> 6 hours, and I'll need to have it back up asap, (within an hour) so I
> need to plan my attack.
>
> So some very naive questions.
>
> Best option: 1) can I retrieve the deleted qcow image from a running
> instance of that image?

If that qemu is still running, then a) find out it's process id (pgrep -a
qemu), b) use that to find the open files of the process (ls /proc/$P/fd), c)
identify the deleted image, and then d) copy that into a new pathname.

Ralph
> ...