Recovering Files from an Image
The great thing about image files is that they are a direct clone of the hard drive, typically bit-by-bit, including "deleted" data. Since files are never truly erased from a partition until they have been written over multiple times, you can use a technique called file carving to retrieve deleted files from an image of a fully functional or corrupt drive. File carving looks at the leading bits of data to recognize a file and its file type. Sophisticated file carving applications can then piece together parts of the file, or the entire thing, from the remnants on the computer's hard drive. Linux can work with a number of file systems as well, including Microsoft's NTFS and the FAT file system commonly used with USB drives.
For Linux there are three main file carving applications that can take recovery images: foremost, PhotoRec, and scalpel. Like the majority of tools so far, they are all run from the command line and are free and open source. Foremost was originally developed for the United States Air Force Office of Special Investigations. Scalpel is a complete rewrite of foremost, aiming to be faster and more efficient. Finally, PhotoRec was originally developed to read data off of corrupted memory cards, but has expanded to encompass all aspects of file carving. PhotoRec is the only application with somewhat of a GUI, having a text-based menu for navigation. All of the applications work the same way. Simply point them at the image file, choose what types of files you want to recover, then wait while the application parses every bit of information possible in the recovery image.
Using foremost to save all of the JPEG image files from an image.
foremost -t jpeg -i recoveryfile.image
Using scalpel to save all of the deleted files from an image to the /mnt/network/drive directory.
scalpel recoveryfile.image -o /mnt/network/drive