The readonly files are in /KNOPPIX/......
The read/write persistent store files are in /KNOPPIX-DATA/......
The copy of files you normally deal with are in /UNIONFS/....

For example the simplest case if you delete a file /etc/a ( ie /UNIONFS/etc/a ),
if there is a /KNOPPIX/etc/a, then there will be a file /KNOPPIX-DATA/etc/.wh.a

So if you delete /KNOPPIX-DATA/etc/.wh.a, you will recover /etc/a.

Search the internet for more info along the line 'unionfs' and 'undelete'.