Read raw HD partition in Linux at a particular offset

Question

I'm trying to recover some files deleted from a Linux ext3 partition. I've grepped the raw partition device (/dev/sda1) using grep -b and it gave me an offset. What's the easiest way for me to read a chunk of data from that block device starting from the offset returned by grep?

Answer 1

With dd: set the block size to 1k to simplify the math, then skip that number of blocks to (just before) the offset and copy however many count of blocks you think you might need, using the partition as the input file, to an output file:

dd if=/dev/sda1 of=recovery_file bs=1k skip=4321 count=20