On Mon, Nov 05, 2012 at 11:03:11AM -0800, Joe Linoff wrote:
I am curious about how to re-create a disk image file from a running
guest when the original disk image file is accidentally deleted. This
came up recently during a test scenario but I couldn't figure out how to
do it.
If you have unlinked the image, but qemu-kvm (or whatever hypervisor
you are running) still has it open, you should be able to to recover
it by going to /proc/PID/fd and looking for a file descriptor number
that is a symlink to your deleted image. Just copy it to a safe
place. I would first run sync inside the guest and maybe suspend
it. It would be nice if you could switch it to single user mode with
all filesystems mounted read-only, but whatever you do, avoid
destroying the domain.
Or why not just attach a new disk to the guest and copy stuff inside
the guest?