How to Undelete a Removed File on an ext3 File System

If you accidentally delete a file on ext3, you can recover it using ext3grep. Below is an example where I am trying to restore the file test/tt.

# ext3grep  --dump-names /dev/sda10
Running ext3grep version 0.8.0
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 258
Minimum / maximum journal block: 1546 / 35888
Loading journal descriptors... sorting... done
....

test
test/.tt.swp
test/tt

# ext3grep  --restore-file 'test/tt' /dev/sda10
Running ext3grep version 0.8.0
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 258
Loading group metadata... done
Minimum / maximum journal block: 1546 / 35888
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1223927674 = Mon Oct 13 13:54:34 2008
Number of descriptors in journal: 25686; min / max sequence numbers: 198274 / 210642
Writing output to directory RESTORED_FILES/
Loading sda10.ext3grep.stage2... done
Restoring test/tt
# cat RESTORED_FILES/test/tt 
abc

Also see instruction on how to undelete a file on NTFS partition.

Also, you can try foremost and scalpel packages.