vmware directories deleted but running vm's still up/running/accessible SUSE 10.2 host

I have a good one.  Suse 10.2 running on a Dell PowerEdge server.   On this server I am running the free version of VMware 1.0.1.   I have the VMware server console up and running.. I can access all my Windows 2k3 server vm's through the server console and remote desktop.  

The Virtual Machine directory is /home/Virtual Machines/

I was ssh'd into the host Suse machine and ***GET THIS***  ACCIDENTALLY!!!!!  typed rm -rd /home/

so by the time I realized it wasn't doing what I wanted it to do I hit CTRL+C

ok.  so now I have a MINIMAL Virtual Machine directory (almost completely deleted) but as I mentioned earlier.. All VM's are up/running/accessible!!!!!!   I am copying all important information to EXTERNAL but am afraid to do anything if there may be a chance to get those virtual directories back.

so.. vmware and vm's up and running but the directories which the vm's are no longer there on the host computer..

any suggestions???  HELP PLEASE!!!  I have been looking for undelete stuff but haven't found much..

Pete
panaroniAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Artysystem administratorCommented:
That's known feature of Unix. You may delete file/directory, but while it's is in use, it's deleted only from directory structure (unlinked). Used i-node is freed only after file/directory closure. Even 'df' shows the same disk space until you stop all processes. So, once you stop your VM's, you loose all your virtual disks...

Now how to recover. I know how to do it while files are open. My restore scenario is following.
Before I created a file '/tmp/a', that is used by another program (say tail, in your case it would be vmware).

1) I found PIDs of processes who keeps my file open:

[root@ibm ~]# pgrep tail
4680

2) Find inode numbers of open file with 'lsof' command.
[root@ibm ~]# lsof -p 4680
COMMAND  PID USER   FD   TYPE DEVICE     SIZE   NODE NAME
...not interesting
tail    4680 root    3w   REG    8,2        5  84259 /tmp/a (deleted)
tail    4680 root    4r   REG    8,2        5  84259 /tmp/a (deleted)

3) Determine inode number of 'good' file to be restored, in my case it's 84259

4) Run 'debugfs' with appropriate device (where your /home is mounted), in my case:
debugfs -w /dev/sda2
debugfs 1.35 (28-Feb-2004)
debugfs:

5) In 'debugfs' I did:
debugfs:  cd /tmp
dump <84259> /tmp/a

6) Viola. In /tmp/a is a copy of deleted file (while original file is still opened).

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
sda100Commented:
I have no idea if this would work, but have you tried creating a snapshot?  You may lose the .vmx file, but you can always create a new virtual machine and add your disk, if the snapshot can save it?
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Linux Distributions

From novice to tech pro — start learning today.