The extundelete utility allows you to recover files deleted from ext3/ext4 partitions.
The extundelete installation command in Ubuntu:
sudo apt-get install extundelete
Let’s see the name of the section:
sudo fdisk -l
Unmount the partition so as not to permanently damage the data, for example /dev/sdb1:
sudo umount /dev/sdb1
Or make it read-only access to it:
sudo mount -o remount,ro /dev/sdb1
You can make a backup before starting the recovery procedure:
sudo dd if=/dev/sdb1 of=/home/ixnfo/dump.img
Now you can run extundelete (examples with the directory and file that need to be restored):
sudo extundelete /dev/sdb1 --restore-directory /dirname
sudo extundelete /dev/sdb1 --restore-file /dirname/filename
An example of restoring the contents of a deleted directory after a specified time:
sudo extundelete --after DATE /dev/sdb1 --restore-directory /dirname
The time is specified in UNIX format, an example for converting the format:
date -d "Feb 05 2015 12:00" +%s
Official page: extundelete.sourceforge.net
See also my article:
Data recovery with testdisk