On an ext3 (or ext2/4, pick your flavor) filesystem, how would one extract raw byte data that corresponds to a particular inode directly from the hard drive? Is it possible given, say, an inode number to determine its location on disk (perhaps as an offset from the start of the partition, or some other LBA offset) and then use some utility such as "dd" or a system call (something like lseek except operating on the filesystem?) to read that data without having to reference it as a file? I'm assuming this can be done, perhaps with some sort of driver-level utility ....
imap command in debugfs can tell you where an inode is. Example:
$ debugfs -R 'imap <128901>' /dev/whatever debugfs 1.42.5 (29-Jul-2012) Inode 128901 is part of block group 16 located at block 524344, offset 0x0400
To get a raw dump of inode 128901, you'd seek to byte
524344*block_size + 0x0400 and read
inode_size bytes. You can get the sizes with the
stats command in
debugfs, or the separate utility
dumpe2fs will also give you a complete listing of all the inode storage areas so you can build your own function that performs the equivalent of
imap without actually calling
debugfs every time (or running it interactively). Just remember when you do your calculation there is no inode zero. inode 1 starts at byte 0 of the first block of inodes.
If you want to do this in a C program without external programs then you should look at the
libext2 library, which is used by all the standard ext2 utilities. I haven't used it myself but I suspect with the libext2 documentation plus the source code of debugfs to use as inspiration, you can write your own
imap-like function pretty easily.
... and here's where it occurred to me that maybe you didn't literally mean you wanted the raw data of the inode. Maybe you want the contents of the file that the inode describes. In that case it's even easier.
debugfs has a built-in command for that:
debugfs -R `cat <128901>` /dev/whatever
prints the contents of the file whose inode number is 128901.