The extundelete is a utility that can recover deleted files from an ext3 or ext4 partition.
sudo apt-get install extundelete
$ extundelete --help
$ extundelete /dev/sda4 --restore-all
Check the deleted file inode:
$ extundetele --inode 2 /dev/vda1
File name | Inode number | Delete Status lost+found 2 exampleFile.txt 1234 Deleted httpd.conf.bak 2135 Deleted
Then, restore the file that inode Id is 1234:
$ extundetele --restore-inode 1234 /dev/vda1
WARNING: Extended attributes are not restored. Loading filesystem metadata ... 8 groups loaded. Loading journal descriptors ... 21 descriptors loaded. Writing output to directory RECOVERED_FILES/ Restored inode 13 to file RECOVERED_FILES/file.1234 $ls RECOVERED_FILES/ file.1234
The deleted file has been saved to RECOVERED_FILES on current path.