In this example, we will assume a file named sample1 was deleted from /home/user1. 

Unmount the home directory, to prevent a new file from being created using the same inode as the sample1 file.

[root@server1 ~]# umount /home

Determine the partition that has the /home directory. In this example, the /home directory is on /dev/sda3.

[root@server1 ~]# df 
Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/sda1              1146788     17910    521781   8% /
/dev/sda3             26123452   1271686  24184852  56% /home

Debug the /dev/sda3 file system. This will start the interactive debugfs prompt.

[root@server1 ~]# debugfs /dev/sda3
debugfs: 

At the interactive debugfs prompt, type lsdel to list deleted files. Make note of the inodes of the deleted file. In this example, the inodes are 123456 and 789123.

debugfs:  lsdel
Inode  Owner  Mode    Size    Blocks    Time deleted
123456   1000 100600   1234    3/        Mon Jan  1 06:22:15 2016
789123   1000 100600    123    1/        Mon Mar  7 17:34:26 2016
2 deleted inodes found. 

Use the cat command to view the contents of deleted files.

debugfs:cat <123456> 

Use the mi (modify inode) command to restore the file. Change the deletion time to 0 and the link count to 1.

debugfs: mi <123456>

Remount the directory.

[root@server1 ~]# mount /home

List the contents of /home/user1, and the file should now be restored.

[root@server1 ~]# ls -l /home/user1
sample1