方法一：使用ext3grep
首先下载安装软件，ext3grep 0.10源码包
安装略

testing
>mount /dev/sda6 /test
>cp -r/root/a/* /test
>rm -f /test/menu.sh;rm -rf /test/3z.pdf
>umount /test

>ext3grep /dev/sda6 --ls --inode 2
Running ext3grep version 0.10.1
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 62
Loading group metadata... done
Minimum / maximum journal block: 1007 / 34810
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1243914106 = Tue Jun  2 11:41:46 2009
Number of descriptors in journal: 59; min / max sequence numbers: 13 / 40
Inode is Allocated
Loading sda6.ext3grep.stage2... done
The first block of the directory is 1001.
Inode 2 is directory "".
Directory block 1001:
          .-- File type in dir_entry (r=regular file, d=directory, l=symlink)
          |          .-- D: Deleted ; R: Reallocated
Indx Next |  Inode   | Deletion time                        Mode        File name
==========+==========+----------------data-from-inode------+-----------+=========
   0    1 d       2                                         drwxr-xr-x  .
   1    2 d       2                                         drwxr-xr-x  ..
   2    3 d      11                                         drwx------  lost+found
   3    6 r   48673                                         rrw-------  1z.pdf
   4    5 r   48674  D 1243915723 Tue Jun  2 12:08:43 2009  rrw-r--r--  aaa
   5    6 r   48675  D 1243922142 Tue Jun  2 13:55:42 2009  rrw-------  3z.pdf
   6    7 r   48676                                         rrw-------  4z.pdf
   7  end r   48677                                         rrw-------  5z.pdf
  16  end d  924769  D 1243914581 Tue Jun  2 11:49:41 2009  drwxr-xr-x  AS400
[root@crys ~]# ext3grep /dev/sda6 --restore-file 3z.pdf
Running ext3grep version 0.10.1
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 62
Minimum / maximum journal block: 1007 / 34810
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1243914106 = Tue Jun  2 11:41:46 2009
Number of descriptors in journal: 59; min / max sequence numbers: 13 / 40
Writing output to directory RESTORED_FILES/
Loading sda6.ext3grep.stage2... done
Restoring 3z.pdf
这个时候在当前执行命令的目录下生成了一个叫RESTORE_FILES 的目录，进去看一下，3z.pdf已经恢复过来
[root@crys ~]# ls RESTORED_FILES/
3z.pdf


方法2：