By mistake, I deleted an lxc image file. The container is still running and the file is therefore not yet actually deleted until I stop the container. I'd like to avoid stopping the container as it is quite sensitive.
I tried to find the deleted file with:
for i in $(ls /proc/|grep '^[0-9]*$'); do ls -l /proc/$i/fd|grep delete; done
But this doesn't find my loop device. Same with a simple lsof | vm-
If I run lsof on another image that is not delete, it doesn't show me any process using it: lsof /var/lib/vz/images/100/vm-100-disk-0.raw
. Probably because it's open by the kernel, not a process.
As suggested in comment:
# losetup -l
NAME SIZELIMIT OFFSET AUTOCLEAR RO BACK-FILE DIO
/dev/loop1 0 0 1 0 /var/lib/vz/images/200/vm-200-disk-0.raw (deleted) 0
/dev/loop0 0 0 1 0 /var/lib/vz/images/100/vm-100-disk-0.raw 0
I tried:
debugfs /dev/mapper/pve-data
debugfs: cd images/200
debugfs: lsdel
Inode Owner Mode Size Blocks Time deleted
0 deleted inodes found.
I guess that's because it's not deleted yet. It is a bit risky to just let it get deleted and hope that it appears here and doesn't get corrupted (it's >300Gb)
Inside the container, mount
gives:
/var/lib/vz/images/200/vm-200-disk-0.raw (deleted) on / type ext4 (rw,relatime,data=ordered)
Any solution apart from dumping the entire filesystem and recreating the container entirely ? (Also, the host drive is almost full, I don't have enough space right now to create a second container next to it. I'm afraid that downsizing the storage would actually result it the actual deletion. :(
lsof
and themount
output. – Mathias Weidner Dec 18 '19 at 18:48lsof
won't tell you about the backing files of the loop devices.losetup -l
will tell you that.cat /proc/self/mountinfo
inside the container will tell which loop device is mounted on/
. But that's only half of the story -- if you have enough space on the disk and want just to recover the data, you can justcat /dev/loopX /path/to/save
. If you want to resurrect a file on a live system/partition ... I have no idea how you could do that. – Dec 18 '19 at 19:01