Recover a Deleted File

During an investigation you seized a forensic image, /evidence/case.img, from a staging host. The analyst who triaged it believes the operator deleted a notes file that named what was being exfiltrated — but it's gone from the directory listing. Deleted is not destroyed: on ext4 the directory entry is removed and the inode freed, yet the data blocks survive until reused. Recover the deleted file's contents from the image and report the exfil key it contained: write it to the file /root/case/recovered.txt. The whole recovered notes file, just the key's line, or the bare key value are all accepted — but only the notes: a copy of the image, or strings of the whole image, is not a recovered file and is rejected.