http://www.cs.johncabot.edu/~min/linux/
-
stop in your tracks, do as little as possible with your files
-
let's assume you deleted some files from /home/myaccount/source
-
find out which partition the deleted file is on. For example, run df, and see that /home is a directory under /, which lives on /dev/hda5 (all examples, your case may be different)
-
su to root
-
for safety, umount /dev/hda5 (this may not be possible though)
-
change to a directory on a different partition (/boot for example), and create a temp directory there
-
run debugfs /dev/hda5
-
at the prompt, run lsdel. It will list inode, owner, mode, size, blocks & time of all deleted files on that partition. This list could be long. Near the bottom are your recently deleted files. You'll recognize them by the id (run id to find out your account's id number), filesize, deletion time. Note the inodes of the files you want to recover.
-
run dump < inode > /boot/temp/filename for each file you want to recover. Note: you need the angled brackets around the inode number!
A program which has a more sophisticated interface for doing this is e2undel. (I'll write some info on this program here later).