[plug] USB flash data recovery

[Daniel Foote]

> grab a dd copy before you do anything further in both linux or doze.
> Its probably too late, but its much easier to do this before it is
> totally stuffed up (i.e., macs do some wonderful one way conversions
> when you plug a stick into some of the older ones!, and doze revovery
> utilities may not be successful, so an image means you get more goes at
> it.)
>
> If all else fails, you can "strings" the image and can sometimes recover
> something!

If the data is not actually scrambled on the disk (ie, the FAT is
stuffed but the data is ok) you might be able to use something like
Foremost (http://foremost.sourceforge.net/). Given an image of a disk,
it will look for signatures of files inside that image (it supports
quite a few formats) and then extracts them.

I have not actually used it (solved the problem I had another way),
but it is written by the US government for forensic recovery purposes.

Have fun...

Daniel Foote.