Undeleting (possible?)

[Fernando Schapachnik]

Data recovery scenario (on 6.2): mistake while messing with Mail directory...

cd ~
mv Mail/xMail ..
rm -r xMail (should have rm'ed Mail)
No extra writes to the filesystem. Plenty of extra space.

Now I want to recover xMail (contains mbox files). sleuthkit only finds Mail/xMail with no content. It also doesn't find any of the contained mboxes.

Is there still hope? My (limited) understanding is the content should be more or less intact. Problem is: how do I find it?

Thanks for any pointer!

Fernando P. Schapachnik
fernando at schapachnik.com.ar