Recover deleted data with rm -rf on Wubi?
Unfortunately, whether in wubi or standard ubuntu, when you remove things with rm -rf, its nigh impossible to recover. There are tools out there, but their effectiveness is relatively low when you've used rm -rf
EDIT
One of the tools explained in a comment to this was photorec. It may help to recover data, but it won't restore filenames or paths, so you'll have to figure out what is what on your own. Also, it may not work because you're using Wubi and not a direct-to-drive installation.
It should be possible using photorec... e.g. on my wubi install I did the following:
sudo apt-get install testdisk
sudo photorec /dev/loop0
[proceed]
[none] (partition type table)
P ext4 [search]
[ext2/ext3]
[free] (or I guess you could use [whole])
Then select some place to recover other than the wubi install (I assume you'd run this from a live CD, so select the local hard drive... I used /host/ubuntu )
Then hit Y to select and it runs.
Then check results. Here's some terminal output
bcbc@ubuntu:~$ sudo photorec /dev/loop0
PhotoRec 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org
PhotoRec exited normally.
bcbc@ubuntu:~$ ls /host/ubuntu
disks recup_dir.1 recup_dir.3 recup_dir.5 Ubuntu.ico winboot
install recup_dir.2 recup_dir.4 tedwireless.txt uninstall-wubi.exe
bcbc@ubuntu:~$ cd /host/ubuntu/recup_dir.1/
bcbc@ubuntu:/host/ubuntu/recup_dir.1$ ls
f0270448.txt f1666616.txt f1668496.txt f1791600.txt f2403160.txt
f0270472.txt f1666624.txt f1668528.txt f1791608.txt f2403176.txt
f0270488.txt f1666632.txt f1668560.txt f1791616.txt f2403208.txt
...
If you're running from a live cd, first mount your windows host and then the root.disk:
sudo mkdir -p /media/win
sudo mount /dev/sda1 /media/win #change /dev/sda1 for your own partition
sudo mount -o loop /media/win/ubuntu/disks/root.disk /mnt
Then you can proceed selecting the appropriate loop device.
There are two main approaches to recovering data. The first is file carving which attempts to identify the start and end of files and extract them. This is very good for certain types of files, but you lose the file names and file times. It is particularly good for jpeg images.
The second approach depends very much on the file system. You are probably using ext3 or ext4. If you are using ext3, then sleuthkit should work. However, I believe that sleuthkit doesn't yet handle ext4. If your file system is ext3, try:
sudo apt-get install sleuthkit
and run
fls -r <device name of your home directory>
e.g.
fls -r /dev/sda1
(I haven't used WUBI so I don't know where your home partition might be.)
This will show you the file names which may be recoverable. If they are recoverable, then icat can be used to recover them.