all depend on your root.disk file status. notice that you want to search for a file within your Ubuntu system, which seems to be a more difficult task with these platforms, especially if you write a lot of files and delete and add more data?
Have you used the device since 2015?
Also, not partitioning the hard disk may complicate things a lot.
Topic: deleted. (Read 88 times)
Few years ago I was testing one Linux OS with Wubi on Windows so I am familiar with it and it is was a very bad experience.
is it possible to do a forensic recovery and keep all of the recovered file names intact or in other words, original? that way it would be a lot easier to just search for stuff like wallet.dat
I don't think that any forensic recovery tool fill find what you are looking for, but if you have some backup (root.disk) maybe you can try temporary restoring that Ubuntu OS with Wubi and copy-pasting all files you need. 
Wubi store whole OS on single file, so it might be difficult. But you could try using pywallet which scan whole hard drive. Here's a rough guide (assuming you use Windows),
1. Make a RAW copy of your HDD using https://hddguru.com/software/HDD-Raw-Copy-Tool/
2. Download most recent version of pywallet at https://github.com/jackjack-jj/pywallet
3. Download Python 3 at https://www.python.org/downloads/windows/
4. Run this command. Change "D:\hdd_dump.img" with path of RAW copy of your HDD. Change "100Gio" to size of the RAW copy.
1. Make a RAW copy of your HDD using https://hddguru.com/software/HDD-Raw-Copy-Tool/
2. Download most recent version of pywallet at https://github.com/jackjack-jj/pywallet
3. Download Python 3 at https://www.python.org/downloads/windows/
4. Run this command. Change "D:\hdd_dump.img" with path of RAW copy of your HDD. Change "100Gio" to size of the RAW copy.
Code:
python3 pywallet.py --recover --recov_device D:\hdd_dump.img --recov_size 100Gio --recov_outputdir C:\recovered_wallet
deleted.
Jump to: