email-grep.rb: Pipe it a file system image and it'll spit out emails. And false positives. Assumes a filesystem with 4k blocks, and mails stored in sequential blocks (not unreasonable for most text mails which only span a few blocks).

email-grep.rb

#!/usr/bin/env ruby
#
# Email grepper: Read stuff from STDIN in 4k chunks, look for anything
# resembling an email, dump results to recovery directory

RECOVERY_DIR = '/enter/a/recovery/directory/here'.freeze
EMAIL_REGEX = /Received: |Subject: |Return-path: |Return-Path: /
NULL_BYTE = "\000".freeze
OUT_FILE_PREFIX = 'chunk-'.freeze
MODE = "w".freeze

chunk = ""
chunk_counter = 0
out_file_common = RECOVERY_DIR + '/' + OUT_FILE_PREFIX
out_file_common.freeze
out_file = ""

while !STDIN.eof?
  chunk_counter += 1
  chunk = STDIN.read(4096)
  if chunk.match(EMAIL_REGEX)
    # Determine filename
    out_file = out_file_common + chunk_counter.to_s

    # Append to chunk until we get a null byte
    while !chunk.end_with?(NULL_BYTE)
      chunk << STDIN.read(4096)
      chunk_counter += 1
    end

    # Dump result
    File.open(out_file, MODE) do |f|
      f.write(chunk)
    end
  end
end