Delete a file called abc.

sh:
rm abc.sh
Type the following command:
# debugfs -w /dev/mapper/root
At debugfs: prompt type lsdel command:
debugfs: lsdel
Sample outputs:
Inode Owner Mode Size Blocks Time deleted
2113537 0 120777 3 1/ 1 Tue May 1 06:21:22 2016
1 deleted inodes found.
Get block data, enter:
debugfs: logdump -i <2113537>
Sample outputs:
debugfs: logdump -i <2113537>
Inode 2113537 is at group 129, block 4227074, offset 0
Journal starts at block 25167, transaction 344454
FS block 4227074 logged at sequence 344484, journal block 31233 (flags 0x2)
(inode block for inode 2113537):
Inode: 2113537 Type: regular Mode: 0644 Flags: 0x0
Generation: 1054075619 Version: 0x00000000
User: 0 Group: 0 Size: 15
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 8
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x575965d9 -- Thu Jun 9 18:19:29 2016
atime: 0x575965d9 -- Thu Jun 9 18:19:29 2016
mtime: 0x575965d9 -- Thu Jun 9 18:19:29 2016
Blocks: (0+1): 4247552
No magic number at block 31238: end of journal.
Type the following command:
# dd if=/dev/mapper/root of=recovered.file.001 bs=4096 count=1 skip=4247552
# file recovered.file.001
Sample outputs:
file: ASCII text, with very long lines
View file, enter:
# more recovered.file.001