root@kali:~/Desktop# mmls demo.img
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
001:  -------   0000000000   0000000127   0000000128   Unallocated
002:  000:000   0000000128   0007864319   0007864192   NTFS / exFAT (0x07)
root@kali:~/Desktop# fls -o 128 -d demo.img
-/r * 41-128-1:	cherry.txt
root@kali:~/Desktop# icat -o 128 demo.img 41
This is the 3rd file!
root@kali:~/Desktop# icat -o 128 demo.img 41 > recovered_file.txt
root@kali:~/Desktop# 

mmls is showing the layout of the files, from there we can see the data region is from 128 to 7864319 in the file system. If we want to look at the data we want to set the offset to 128.

fls using the -d option shows only the deleted files in the system, from there we get the deleted file we were looking for and its inode number which is 41 in this example.

icat then reads the file when given the inode specific inode number, which we can the output into a file if we wanted to recover it.