There is a tool called debugfs, with it you can get a list of deleted
files `lsdel', and use the information to restore them with `undel'.

Although lsdel is no longer useful, I'm pretty sure the tool may help
you recreate a link to the existing inodes. I'd recommend reading the
man page.

Excerpt from the man page:

  undel <inode_number> [pathname]
         Undelete the specified inode number (which must be surrounded
         by angle brackets) so that it and its blocks are marked in
         use, and optionally link the recovered inode to the specified
         pathname.  The e2fsck command should always be run after using
         the undel command to recover deleted files.

         Note that if you are recovering a large number of deleted
         files, linking the inode to a directory may require the
         directory to be expanded, which could allocate a block that
         had been used by one of the yet-to-be-undeleted files.  So it
         is safer to undelete all of the inodes without specifying a
         destination pathname, and then in a separate pass, use the
         debugfs link command to link the inode to the destination
         pathname, or use e2fsck to check the filesystem and link all
         of the recovered inodes to the lost+found directory.

On 16/07/20 12:35, fraser kendall wrote:
> I have just done the stupidest thing. I was freeing up (rm -rf) space
> on what I thought was a storage directory (/srv), but I have now just
> discovered that it contained a critical qemu image. The image is a W7
> VM and is still running; it appears unaffected. The /srv partition
> is the largest on this machine and the testdisk recovery image of this
> partition (~170G) is too large to fit anywhere on the hard drive.
>
> This machine is mission critical. I cannot take it offline for another
> 6 hours, and I'll need to have it back up asap, (within an hour) so I
> need to plan my attack.
>
> So some very naive questions.
>
> Best option: 1) can I retrieve the deleted qcow image from a running
> instance of that image?
>
> Fall back option: 2) does anyone know if a new installation of the
> (Dell) W7 iso will still activate now that W7 is EOL?
>
> I know that option 2 (writing to disk) will reduce the possibility of a
> testdisk recovery. So, here's Q3: can i squeeze the second W7 VM into a
> 6G qcow image (remaining free space in /home)?
>
> I'm not going to do anything for a while, except think. And hide from
> the boss. All help would be appreciated.
>
> fraser
>
> _______________________________________________
> Dng mailing list
> Dng@???
> https://mailinglists.dyne.org/cgi-bin/mailman/listinfo/dng
>