The other day I learned that you can just grep an unmounted filesystem device. It will read the entire disk sequentially like it’s one huuuuge file. And it will reveal everything on that disk… whether a file inode points to it or not.

Used it to recover data from a file I accidentally clobbered with an errant mv command. It’s not reliable, but when you delete a file, it’s usually not truly gone yet… With a little luck, as long as you know a unique snippet that was in it, you can find it again before the space gets something else written there. Don’t even need special recovery tools to do it, just use dd in a for loop to read the disc in chunks that fit in RAM, and grep -a for your data.