Data recovery on physically damaged key

Question

I am currently in possesion of a physically damager USB key: when any software try to read clusters from 3,981,812 to 3,981,817, the USB drive crash and I have to unplug, and plug again the key to be able to "read" data again. I'm trying to get back any files on it that I can get.

I got 2 raw files from 0 to 3,981,812 and 3,981,817 to the end of the key with DatarescueDD, but i'm unable to get anything back from this: I can't mount them with anything, no software are able to deep scan them.

Do you have ay idea of how to get date back from the dd files, or do a deep scan on the USB drive by skipping corrupted clusters ?

Answer 1

This image probably don't contain valid filesystem so it cannot be mounted.

The idea behind creating dd image is that you can save image and run as many recoveries without risk of further degrading the media.

You still need to do file recovery for example

Answer 2

Finally I found a way. For my example I will take a USB with 100 sector, and 54-55 are corrupted:

1. Use DatarescueDD to generate raw chunk of working cluster.

   • Generate image1.dd with sectors 0-53
   • Generate image2.dd with sectors 56-100

2. Use dd to generate an empty chunk of cluster. For windows you can use this dd

   • I used the command .\ddrelease64.exe bs=512 count=10000 if=/dev/zero of=empty.dd

3. Merge all dd.

   • I used the command in powershell cmd /c copy /B image1.dd+empty.dd+image2.dd result.dd
4. Mount the result.dd
   • I used AccessData FTK Imager on Windows
5. Use a file recovery tool on the mounted *.dd, like Recurva.
6. Voilà !