Solved

vmware directories deleted but running vm's still up/running/accessible SUSE 10.2 host

Posted on 2007-04-02
2
509 Views
Last Modified: 2013-12-05
I have a good one.  Suse 10.2 running on a Dell PowerEdge server.   On this server I am running the free version of VMware 1.0.1.   I have the VMware server console up and running.. I can access all my Windows 2k3 server vm's through the server console and remote desktop.  

The Virtual Machine directory is /home/Virtual Machines/

I was ssh'd into the host Suse machine and ***GET THIS***  ACCIDENTALLY!!!!!  typed rm -rd /home/

so by the time I realized it wasn't doing what I wanted it to do I hit CTRL+C

ok.  so now I have a MINIMAL Virtual Machine directory (almost completely deleted) but as I mentioned earlier.. All VM's are up/running/accessible!!!!!!   I am copying all important information to EXTERNAL but am afraid to do anything if there may be a chance to get those virtual directories back.

so.. vmware and vm's up and running but the directories which the vm's are no longer there on the host computer..

any suggestions???  HELP PLEASE!!!  I have been looking for undelete stuff but haven't found much..

Pete
0
Comment
Question by:panaroni
2 Comments
 
LVL 27

Accepted Solution

by:
Nopius earned 500 total points
Comment Utility
That's known feature of Unix. You may delete file/directory, but while it's is in use, it's deleted only from directory structure (unlinked). Used i-node is freed only after file/directory closure. Even 'df' shows the same disk space until you stop all processes. So, once you stop your VM's, you loose all your virtual disks...

Now how to recover. I know how to do it while files are open. My restore scenario is following.
Before I created a file '/tmp/a', that is used by another program (say tail, in your case it would be vmware).

1) I found PIDs of processes who keeps my file open:

[root@ibm ~]# pgrep tail
4680

2) Find inode numbers of open file with 'lsof' command.
[root@ibm ~]# lsof -p 4680
COMMAND  PID USER   FD   TYPE DEVICE     SIZE   NODE NAME
...not interesting
tail    4680 root    3w   REG    8,2        5  84259 /tmp/a (deleted)
tail    4680 root    4r   REG    8,2        5  84259 /tmp/a (deleted)

3) Determine inode number of 'good' file to be restored, in my case it's 84259

4) Run 'debugfs' with appropriate device (where your /home is mounted), in my case:
debugfs -w /dev/sda2
debugfs 1.35 (28-Feb-2004)
debugfs:

5) In 'debugfs' I did:
debugfs:  cd /tmp
dump <84259> /tmp/a

6) Viola. In /tmp/a is a copy of deleted file (while original file is still opened).

0
 
LVL 9

Expert Comment

by:sda100
Comment Utility
I have no idea if this would work, but have you tried creating a snapshot?  You may lose the .vmx file, but you can always create a new virtual machine and add your disk, if the snapshot can save it?
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

SSH (Secure Shell) - Tips and Tricks As you all know SSH(Secure Shell) is a network protocol, which we use to access/transfer files securely between two networked devices. SSH was actually designed as a replacement for insecure protocols that sen…
Linux users are sometimes dumbfounded by the severe lack of documentation on a topic. Sometimes, the documentation is copious, but other times, you end up with some obscure "it varies depending on your distribution" over and over when searching for …
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now