What to do if you've deleted a file (or multiple files)

http://extundelete.sourceforge.net/

Do not save any more data to the partition with the deleted file for any reason! Doing so may overwrite your deleted data and sabotage any recovery effort. Many background processes will periodically write to disk, so work quickly until the partition is unmounted.

If you think the file may be still open by some program (for example, if it is a movie file currently being played by a movie player), and you know the filename, then first follow this procedure:
$ lsof|grep "/path/to/file"
progname 5559 user 22r REG 8,5 1282410 1294349 /path/to/file
Notice the number in the second column is 5559 and the number in the fourth column is 22. The command to restore that file is:
$ cp /proc/5559/fd/22 restored.file

1.如果该文件正在被一个程序打开使用，可以参照以上方式进行恢复。

If lsof doesn't find your file, then immediately remount the partition read-only:
$ mount -o remount,ro /dev/partition
or unmount the partition:
$ umount /dev/partition
Typically, you would replace "partition" in the above examples by a device name like "sda4" or "hdb7". When either of those commands successfully completes, you can now take the next steps leisurely - you will no longer make anything worse by waiting. If you would like to make a backup of your partition, you may do so by a command such as:
$ dd bs=4M if=/dev/partition of=partition.backup

2.将分区以只读的方式进行挂载或者直接卸载分区，使用dd进行备份。

Now is the time to run extundelete, which you may safely run on either the backup you may have made above or the raw device, as long as it is not mounted (or mounted read-only). See the section above for details on how to use this program.Ifextundelete was unable to recover your files, then you may try to recover your files withdebugfs, a tool included with the e2fsprogs package.If you unmounted the partition before the file system got a chance to fully delete the files you are interested in, running debugfs may allow you to recover the files before the file system deletes them (which it may do the next time the partition is mounted). The 'dump' and 'rdump' commands in debugfs may be useful to you for these purposes.If you were unable to recover your files usingextundelete ordebugfs, then you may try to recover your files withext3grep orext4magic. The generation of ext3grep's stage2 cache file depends on the size and speed of your hard drive's partition, with typical speeds close to one minute for every 2 GB (30 s per GB, or 8 hours per TB).

If the above options didn't recover your files, then you may try a program that searches for identifying patterns throughout the entire partition, likeforemost,scalpel, orPhotorec.ext3grep's --search options may also be used for this purpose.