[Gllug] recovering files from USB flash drive

[J F]

Sorry for the long email....

I bought a 512 MB USB flash drive recently, and copied an important, gpg-encrypted .tar file to it (not 'armored'), along with two 
ASCII text files.

Some days later, I tried to access these files and for some strange reason, the ASCII text files turned into a bunch of ÿ's, opening 
them with hexdump gives me a load of FF's.

Then I tried to decrypt the .tar file: GPG asks for the passphrase then proceeds to decrypt the file using the secret key, but it 
stops after a while and gives me a zlib error. I seems the GPG file was damaged too. The file was around 170MB and GPG 
manages to decrypt around 40MB. I am able to untar this 40MB file, but obviously it gives me an error saying the archive is 
incomplete. Does GPG or Tar have a recovery feature?

I made a 'dd' image of the drive and I'm hoping that the missing (if it is missing) part of the file is somewhere inside it. How 
should I go about finding it? I think it's a FAT32 partition. How can I identify a chunk of data as being part of this missing file? It 
seems GPG compresses the file, but does it do so before or after encrypting it?

The file contained some JPEGs, that used to be in a windows partition. If I can't recover the file from the flash drive, I'm thinking 
of looking for deleted jpegs in my windows partition. Do JPEGs start and end with any special magic codes?

-- 
_______________________________________________
Check out the latest SMS services @ http://www.linuxmail.org
This allows you to send and receive SMS through your mailbox.

Powered by Outblaze
-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug