This article is from the Frequently Asked Questions for Linux, the Free/Open Source UNIX-like operating system kernel that runs on many modern computer systems. Maintained by David C. Merrill with numerous contributions by others. (v1.0).
A: In general, this is very hard to do on unices because of their multitasking nature. Undelete functionality for the ext2fs file system is being worked on, but don't hold your breath.
There are a number of packages available which instead provide new commands for deleting and copying which move deleted files into a "wastebasket" directory. The files can be recovered until cleaned out automatically by background processing.
The Midnight Commander file manager provides an undelete facility that uses Ext2 file system library functions and an undelete directory for each file system. Commercial distribution packages of MC may or may not have this feature enabled, so be sure to look in the source code distribution for instructions on how to enable the undelete feature.
Alternatively, you can search the raw disk device which holds the file system in question. This is hard work, and you will need to be logged in as root to do this. But it can be done. Run grep on the raw device; e.g.:
grep -b 'bookmarks' /dev/hda
If the data has not been overwritten, you should be able to recover it with a text editor.
[Dave Cinege, Daniel Novotny]