Recover a deleted file from a hard drive while the filesystem and drive are still intact
sudo apt install sleuthkit
m-usr@debian:~$ su
Password:
root@debian:~# lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sdc 8:32 0 3.7T 0 disk
├─sdc1 8:33 0 128M 0 part
└─sdc2 8:34 0 3.7T 0 part
sr0 11:0 1 1024M 0 rom
root@debian:~# sudo fls -r /dev/sdc2
r/r 65539: Spare Drive (Volume Label Entry)
r/r 65540: $ALLOC_BITMAP
r/r 65541: $UPCASE_TABLE
d/d * 65542: test
+ r/r * 98307: deletedFile
+ r/r * 98310: .goutputstream-YP7MI1
v/v 125019815939: $MBR
v/v 125019815940: $FAT1
V/V 125019815941: $OrphanFiles
root@debian:~# sudo icat -r /dev/sdc2 98307
TextInsideDeletedFile
thanks to possiblelossofprecision.net/?p=1216