Resolvido com a ajuda da resposta aceita aqui: Arquivos sobrescritos podem ser recuperados?
For larger files that may be in multiple non-contiguous blocks, I do this:
grep -a -b "text in the deleted file" /dev/sda1 13813610612:this is some text in the deleted file which will give you the offset in bytes of the matching line. Follow this with a series of dd commands, starting with
dd if=/dev/sda1 count=1 skip=$(expr 13813610612 / 512) You'd also want to read some blocks before and after that block.
Eu precisei definir a contagem para 10 para obter meu arquivo inteiro, tem que ser escolhido pelo tamanho do arquivo.