To recover deleted files you need extundelete (from the repository or its project page).
possibly outdated More than two years have passed since publication. The content may no longer hold.
Procedure
- Work from a location with enough free space where you can read and write:
cd /your/rw/folder
- Remount the affected disk read-only, so nothing overwrites the deleted data:
umount /dev/xxx mount -o ro /dev/xxx /media/yyy
- Find the inode of the folder that held the deleted files:
ls -id /path
- Run the recovery by inode:
extundelete /dev/xxx --restore-inode NNNN
Notes
extundelete writes the recovered files to a RECOVERED_FILES directory in the current directory. That directory must therefore be on a different partition from the one being recovered – writing to the source partition could overwrite the very data being recovered.
extundelete also has options for filtering – restoring a whole directory, restoring since a date, or restoring everything. See its documentation.
_Originally published in December 2012._