Snippets

Recovery files/contents: filter for known pattern
The grep solution worked for me with a modification: I did sudo grep --line-buffered -ab "$PATTERN" /dev/sda1 | tee lines and got byte offsets (like 123123123:line\n456456456:another\n...), then did n=1000; sudo dd of=before if=/dev/sda1 ibs=1 skip=$[123123123-$n] count=$n and n=1000; sudo dd of=after if=/dev/sda1 ibs=1 skip=123123123 count=$n with different n values

Other Programs:
ext3grep, ext4grep, zfs (snapshots and so on, read the docs, it's awesome)
Also a good tut on: itsfoss.com/recover-deleted-files-linux/