How to retrieve the data that was mistakenly deleted from the Linux system?

Emergency, the application upload data is automatically deleted by the program, sadly there is no data backup, the data is placed in the system's/data/webapps/xxxx/upload directory below, can put us nasty, and did not do the data recovery test, and then I found a data recovery software, The majority of the deleted data was successfully returned.

Restore all data can use command

Extundelete/dev/sda5--restore-all

How to use

Extundelete--help

Among them, the parameters (options) are:
--version,-[VV], displays the software version number.
--help, display software help information.
--superblock, displays the Super block information.
--journal, displays the log information.
--after Dtime, a time parameter that represents a file or directory that was deleted after a certain period of time.
--before Dtime, a time parameter that represents a file or directory that was deleted before a certain period of time.
Actions are:
--inode Ino, displays the information for the node "Ino".
--block Blk, displaying data block "blk" information.
--restore-inode Ino[,ino,...], restore the command parameters, representing the recovery node "ino" file, the recovered files are automatically placed in the current directory Restored_files folder, using the node number as the extension.
--restore-file ' path ', which restores the command parameter, indicates that the file of the specified path will be restored and the recovered file is placed in the Recovered_files directory in the current directory.
--restore-files ' path ', which restores the command parameter, indicates that all files listed in the path will be recovered.
--restore-all, restore the command parameter, indicating that all directories and files will be tried.
-j Journal, which indicates that the extended log is read from a file that has been named.
-B blocknumber, which means using a previously backed up super block to open the file system, is typically used to see if an existing super block is currently the desired file.
-B blocksize, which opens the file system by specifying a chunk size, is typically used to view files that already know the size.
After the data is deleted, the first to unload the deleted data on the disk or partition, if the system root partition was mistakenly deleted, you need to enter the single-user mode, the root partition is read-only mount.

Cause: Because after the file is deleted, just the sector pointer in the Inode node of the file is zeroed out, in fact the file still exists on the disk, if the disk is mounted in read-write mode, the deleted data blocks may be newly allocated by the system, the data blocks are overwritten, the data is really lost, So mount it in a read-only manner and avoid overwriting the data as much as possible.

How to retrieve the data that was mistakenly deleted from the Linux system?