Depending upon version of Moodle and settings ... and how hard you want to work at recovery ...
There is recyclebin ... in admin setting for recyclebin set to show all the time. Go ot course where forum used. See if the forum posting is in recyclebin. Issue with that ... don't think one has the option to download, only restore. Once restored not sure one can hide that posting in the forum. But once restored, attachment should be there (maybe). That one might be able to download, and once downloaded, the posting deleted again.
The other ... trashdir in moodledata.
You'd have to query the DB mdl_files table and look for all files that end with .docx (or .doc) to get where it might be located (trashdir) ... the files contenthash value. The contenthash value is both where the file is in the moodle file system ... normally moodledata/filedir/xx/yy/contenthashvalue ... (this case trashdir) and it's name in the file system ... which is the contenthash value.
Once one has that info, a command line find for 'contenthash' value in either moodledata/filedir or moodledata/trashdir will show location of the file and one can copy that file out to someother directory and change it's name on the fly.
Recyclebin default is I think 3 days ... after that, file is moved to Trash. Trash is normally emptied after 4 days. So depending upon when this deletion took place, you might still have time to recover.
A raw command line find in moodledata/trashdir/* for file type - think it would show as 'Indian' something - one could find all .doc or .docx files in there, copy them out ... compare them all ... to find the one.
cd /path/to/moodledata/trashdir/
Example commands:
[root@moodle trashdir]# ls -1 ./*/*/*
Would render:
./05/68/0568b6afd049daf3326bbbaa9584bc741b83b499
./08/e0/08e0f99fd6dc25585884bc9a767cc5b3dcb64dec
./15/f6/15f6ca0e74097ed623c3678c17de9b0f38b210da
./1c/15/1c15650f3a392bdb31bbbbb699b84776cccb8c89
./2a/d5/2ad59119cc2780a58ad07f1b9a80911e7eee6475
./2d/a4/2da4b683281f505884046a8390b86cd9c4bc3abf
./2e/da/2edaeeae81151ccb2e9a3c50c9a0583fb01511bf
./49/3c/493cc5de2ea074975d409469b6e0536ddace5e19
./61/96/619612768f5392fc3a8ab772656d8e5002dea71d
./62/69/62698ef27c845e5289f655d7f41b87f38928dd33
./69/48/6948fdd8963bca583a5864062de896a85b9a545c
./6b/4f/6b4fa8952f094322d8aa90e41d9564e2e9bbd26c
./7d/03/7d03d38e6cc326a3e1e8c4894f14edba4a5a247c
./a4/c1/a4c1f7561bd4c690afa0f33eb900c8868fe8cbbc
./af/5d/af5d1cc12f8ceb1646acd8735a7a2ab6fe49973f
./be/5d/be5d8179010fb09912debeb826b9141102279772
./e1/a2/e1a21e3f1ba1e3fde3c30bd09ec6d9af58afaa5c
./ed/00/ed00c2ba2f5680d603e160823a291b4b6f361a88
./f9/42/f94275732bfb79c38aa6066cfc3f665fb8acdc39
./fd/f6/fdf68ca74d3e99b8d462a49304a6e1dfcf012992
Then, from same location a file -b command for each of above:
file -b ./fd/f6/fdf68ca74d3e99b8d462a49304a6e1dfcf012992
In this example, renders:
PNG image data, 827 x 1069, 8-bit/color RGB, non-interlaced
You'd be looking for file mime types for a Word doc or docx.
Good luck!
'SoS', Ken