{"id":3456,"date":"2018-08-10T01:47:39","date_gmt":"2018-08-09T17:47:39","guid":{"rendered":"https:\/\/www.bytebot.net\/blog\/?p=3456"},"modified":"2018-08-10T01:47:39","modified_gmt":"2018-08-09T17:47:39","slug":"thumb-drive-data-recovery","status":"publish","type":"post","link":"http:\/\/www.bytebot.net\/blog\/archives\/2018\/08\/10\/thumb-drive-data-recovery","title":{"rendered":"Thumb drive data recovery"},"content":{"rendered":"

I haven’t done any data recovery or data rescue work in sometime (the last time was on Linux, with a combination of dd<\/code>, ddrescue<\/code>, and some throwaway code to parse JPGs – it was a Compact Flash card that needed saving). This time, all I had was macOS, a 16GB thumb drive, and the files were someone’s life’s work, which were more than just JPGs but also AI (adobe illustrator), DOC, XLS, PDF, TTF, etc. files. <\/p>\n

So via Homebrew, I installed ddrescue<\/code> again. A command like ddrescue -v -n -c 4096 \/dev\/disk2 helena.dmg helena.log<\/code> seemed to work. On macOS, fdisk<\/code> totally couldn’t get me anything useful and if I ran diskutil list<\/code> the output would be as follows:<\/p>\n

\/dev\/disk2 (external, physical):\n   #:                       TYPE NAME                    SIZE       IDENTIFIER\n   0:                                                   *15.5 GB    disk2\n<\/code><\/pre>\n
For good measure I wanted to also make an image via dd<\/code>, dd if=\/dev\/disk2 conv=sync,noerror bs=4096 of=helena.img<\/code>. It was clearly throwing many errors, an example of which:<\/p>\n
13399375872 bytes transferred in 1263.864380 secs (10601910 bytes\/sec)\ndd: \/dev\/disk2: Input\/output error\ndd: \/dev\/disk2: Input\/output error\n<\/code><\/pre>\n
The real problem was mounting either the DMG or the IMG. On Linux you have this option to loopback mount a file; on macOS this isn’t quite there. There is hdiutil<\/code> but frankly, this doesn’t work if there is no partition record. I tried to mount it using hdiutil attach -noverify -nomount helena.img<\/code> but that didn’t work to then do a diskutil mountDisk<\/code>. <\/p>\n
Then… I found a tool: PhotoRec<\/a>. I wouldn’t have to write something to parse the magic numbers and extract files. PhotoRec just works<\/em>. It parsed the IMG file, and spat out plenty of files to look at. Recovery was generally full. <\/p>\n
For reference, on Linux, there are some good resources: Mounting a raw partition file made with dd or dd_rescue in Linux<\/a>, and Guide to Using DDRescue to Recover Data<\/a>. From a forensic standpoint, Disk-Arbitrator<\/a> looks like a good tool as well.<\/p>\n
Share this:<\/h3>