1. Disconnect/unmount the partition containing the database immediately. If it your system partition, don't start the OS. In that case all recovery work should be done from a Live-CD/USB.
2. Make a copy of the partition in question, you will do the recovery work on the copy, not the original.
3. Use Photorec to try to recover the database from the copy. To speed the process up let it only search for the type of database you use, you can specify that in Photorec's options.
4. While Photorec is working, think about a good backup plan for the future and also the attack vector the hacker used to secure your systems.
Good Luck!
|