Corrupted USB flash key recovery

There are only two kinds of people in the world, those who have lost data and those who are about to. — Anon

The 128Mb Swisskey belongs to a friend and contained the only edited copy of a manuscript she has been working on. She had forgotten to "trash can" or eject it before removing it from her Mac and could no longer read anything from the key. It's doubtful whether the act of removing the key caused the corruption but there does seem to be a link.

The first thing I tried was reading the raw key image.

# dd if=/dev/sda of=key.img
500+0 records in
500+0 records out
131072000 bytes (131 MB) copied, 132.2937 s, 1.0 MB/s
#

I repeated this step to create another image file and then compared their md5 signatures to make sure the key wasn't corrupting the data itself. The next thing I did was try to mount the image.

# mount -o loop -t vfat key.img /mnt/usb
mount: wrong fs type, bad option, bad superblock on /dev/loop0,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

#

read more after the break...

posted by James Gemmell on Thu, 15 Mar 2007 at 10:31 | permalink | tags: recovery