Both TestDisk and PhotoRec utilities work in the interactive fashion, gradually refining recovery options.
It is enough to unmount a partition, from which we are going to recover files, execute "testdisk" and select the desired recovery options.
The demonstration of the recovery process is given in the screenshot reviews:
http://www.cgsecurity.org/wiki/TestDisk:_undelete_file_for_ext2
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
The second way is more suitable for Ext3 users and is associated with the use of ext3grep tool.
Install ext3grep (http://code.google.com/p/ext3grep/) or better boot from the LiveCD which contains the utility, for example PartedMagic (http://partedmagic.com/), occupying about 50 Mb.
Let's suppose that files from the directory /home/test/db, located on the ext3 /dev/sda6 partition, were accidentally deleted.
The faster we attempt to recover them, the higher the probability of success is.
We make sure that the /dev/sda6 partition is not mounted. And go to the directory, available for writing and having enough space for the recovered files.
To recover the /home/test/db/test.txt file we run
ext3grep /dev/sda6 --restore-file test/db/test.txt
To recover the directory
ext3grep /dev/sda6 --restore-file test/db
The recovery results will be placed in the RESTORED_FILES directory, which will be created by ext3grep utility in the current directory.
We can view all found file names by executing the following command:
ext3grep /dev/sda6 --dump-names
To recover all the files deleted from the time 1202351117:
ext3grep /dev/sda6 --restore-all --after=1202351117
If 30 minutes passed after removal, you can see a timestamp, for example, as follows:
perl -e 'print time()-30*60';