Recovering a deleted file that is still held open

I accidentally deleted the disk image file for a running virtual machine. oopsy!

Luckily, there is an easy way to undo that using the lsof command!

lsof | grep /home/qemu/images/my-disk-image.qcow2

This produces output like this;

qemu-kvm  24816      root    9u      REG              253,2 214781394944   21102665 /home/qemu/images/my-disk-image.qcow2 (deleted)

Take note of the first two numbers, which in my case are 24816 and 9 (Note: you must strip the trailing char from the second number)

Pause the VM  (don't stop it!) so that the disk is not being written to while we do the next step.

Now you just need to copy the deleted file back to somewhere safe;

[root@devkvm03 images]# cp /proc/24816/fd/9 my-disk-image.qcow2