For this example, I'm using "MYGROUP" as the
- First, create a strings file from the .img file. srch_strings _a -t d sample.img > sample.asc
- Now, we can grep for a particular string. grep MYGROUP sample.asc This will return the offset of the string. There could be more than one return, so you may have to run the process a couple of times; steps 3-7 would be repeated.
- Now we need to find the original_block_number. To do this, we divide the offset from step two by the default blocksize of the filesystem. To find the default blocksize, I run the following command: fsstat sample.img | grep "Block Size:"
- Now, I usually check that the block number in step has data. I run a blkcat sample.img
original_block_number (from step 3)
- To find the inode_num that the block number from step three points to: ifind sample.img -d
original_block_number. The result will be the inode_num
- To ensure that the inode number points to blocks: istat sample.img
- Finally, we can use the inode number to pull the file name that we're looking for. Run: ffind sample.img
edit 10-5-09: I went back through these directions and they were written pretty badly. So, I've updated them for clarity.