Corrupt USB Flash Drive Data Recovery on Mac OS X Mavericks

An oldy but a goody…

  • Identify the device node
    Remove the drive from the computer then run
    $ ls /dev/rdisk*
    Insert the drive and re-run the command, for me a new device /dev/rdisk3 shows up
  • Checkout what might be wrong
    $ sudo dmesg | tail
    ...
    disk3s1: I/O error.
    0 [Level 3] [Facility com.apple.system.fs] [ErrType IO] [ErrNo 5] [IOType Write] [PBlkNum 14988] [LBlkNum 0]
    0 [Level 3] [Facility com.apple.system.fs] [DevNode /dev/disk3s1] [MountPt /Volumes/Lexar]
  • Make an image of the disk
    $ dd bs=64k if=/dev/rdisk3 of=./recovered.dmg conv=noerror,sync
    478816+0 records in
    478816+0 records out
    31379685376 bytes transferred in 1278.080407 secs (24552200 bytes/sec)
  • Try mount the created image in Finder (unlikely)
  • Install foremost for data carving
    $ brew install foremost
    ==> Downloading http://foremost.sourceforge.net/pkg/foremost-1.5.7.tar.gz
    ######################################################################## 100.0%
    ==> make mac
    🍺 /usr/local/Cellar/foremost/1.5.7: 5 files, 84K, built in 29 seconds
  • Run foremost on the image
    $ foremost -i ./recovered.dmg -o ./recovered
  • Browse the glorious recovered data!
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s