Sleuthkit icat

icat image.dd <inode> > file

Extract the contents of a file by its inode with icat, recovering the file from the image even if it was deleted.

Run it when the analysis (fls, the timeline) has given you an inode and you need the file: icat extracts the inode's content from the image — the payload, the script, the document — without mounting the filesystem. It also works with inodes of deleted files (those that fls -d lists): recovering the attacker's artifact from raw data. In IR, it's the extraction step: from the timeline line to the file on the analyst's desktop, ready for hashing, YARA, and sandboxing. The inode and the partition offset are the input data.

Don't use it with the wrong inode: the inode that fls gives you is for the analyzed partition (with its offset) — using an inode from another partition or without the correct offset extracts garbage or fails. On deleted files whose blocks have already been reallocated, icat extracts partial data or data from the new file — recovery is not guaranteed. And watch out: icat extracts the content, not the name or metadata (that's what fls/istat provide) — for the case, document the inode, the original path, and the hash of the extracted file. For large or fragmented files, extraction may fail; carving alternatives (bulk_extractor, foremost) cover those cases.