What should do now that I have accidentally truncated a file I don't have a backup of?
I'm Running KVM Server 300Gb vmdk file size When I want to backup my server, I run script (note Sending server: 192.168.13.95, Receiving server 192.168.13.91)
#tar cv vm-102-disk-1.vmdk | nc -q 1 192.168.13.91 1234
on my sending server and run script
#nc -w 10 192.168.13.95 1234 > vm-102-disk-1.vmdk
Unfortunately I run it in my sending server too from another console actually I know that I have to run that script from my receiving server
That mistake cost me my vmdk file 300Gb rewritten to 0bytes Is there someway to recover it?
Files are stored on disk as a series of logical blocks, usually 512 bytes or 4096 bytes. When a file is truncated to 0 bytes (which is apparently what happened here), that means the filesystem updated the file's metadata so that none of the blocks it previously claimed as part of the file are part of the file anymore.
In fact, those blocks that used to be part of the file will now be marked as free space.
Since most active systems perform between dozens to thousands of disk writes per second (updating log file, performance accounting, background update processes, user inputs, etc.), the hard disks's free space will have a tendency to get used in a very random, "fragmented" way, with small bits of information being allocated from blocks that were marked as free from all over the disk.
It's a little like taking a good painting, and letting someone randomly fling paint from a bucket all over the painting. It gets ruined very quickly. What was once your ordered data (the intact VMDK image) will quickly become a jumbled series of bits, most of which are still your VMDK, but with randomly interspersed chunks of other files.
To prevent this, the best thing to do is to be aware of what to do when this happens.
If you do not have a backup of the file you just truncated, what you need to do is to pull the plug on your system RIGHT AWAY. And by pull the plug, I mean, yank it out of the wall. Remove electrical power from the system. If it's a laptop, unplug it and remove the battery.
Shutting down a computer often runs dozens of system administration scripts that perform lots of writes to disk. That's the person flinging paint randomly at your masterpiece. You don't want that.
In this case, pulling the plug is the least harmful thing you can do.
Then, once the power is removed, you can calm down, take a breather, and start thinking logically about how you are going to recover the data. But whatever you do, don't turn the system on and boot it up from that hard drive again until AFTER you recover your data.
--
The canonical, general-purpose, Super User data recovery post is located here.