ext4 extract files

[doctorsu]

I need to locate file in ext4 system.img offset to extract it fast I don't need to use tools for doing it
what is the area for mapping and has the info about files in ext4 img
I need to know where is the offset of file I need to extract it fast

[doctorsu]

1- I wont to extract file I don't wont make mount for ext4 2- I wont to just extract file not mount or restore 3- I wont to know physically offset of the file I wont to extract from the ext4 area or file that responsible of save data of what offset is my file started and size of it

[RevoComputers]

It's easiest to use a tool like ext2read after you unpack the IMG. It's like a directory browser for the IMG without mounting it.

Otherwise you can mount it to a loopback device easily to pull the file out.

I don't know how to determine the file offset within the IMG but you can use Sleuthkit to find the file and size, then dd it out.

ck@ck:~$ fls -r -l decomsys.img | grep phonemeSearch
++ r/r 5152: phonemeSearch_1_3.raw 2008-12-31 08:00:00 (MST) 2008-12-31 08:00:00 (MST) 2008-12-31 08:00:00 (MST) 0000-00-00 00:00:00 (UTC) 548074 0 0

ck@ck:~$dd skip=7337498 count=548074 if=decomsys.img of=singlefile.file bs=1