Why not make a raw dump and look for lost keys there? If the hdd hasn't been used to write data since then, it makes sense.