by HJWUCGA INC..
Yes... we've recovered quite a bit simply by doing a full backup (database& moodledata) on a daily basis. Being safe is indeed better than sorry.
And the best way to find the files is to obtain a backup copy of the db before a problem has occured. Take this backup and rename the db to something else. Create an empty db. Restore the backup db into a temporary db. Then query it for the courseid. This will give you the name of the files you are looking for. Make note of the contenthash. Now get the files from a back up around the same period before the error occured.
The trashdir is now emptied at every cron run.