Well, why don't you simply open the files in a hex editor/viewer?
As said from the info you provided the dd command could still be off by one sector.
BTW even if it was the right start sector address, the file you extracted with dd is 48 sectors whilst the original was seemingly 47, so the MD5 Sum would not match anyway.
There is still a further possibility (sorry but I am not familiar with istat output), that the istat numbers sectors in yet a different way (as an example by numbering only sectors belonging to the actual file system file area, bypassing the initial reserved sectors and those used by the FAT tables).
You can also well get from the "rightly extracted" file the Excel header (if I recall correctly different versions of Excel have a different header) and grep/cat (or whatever) the image for the header string, you should have a number of hits, and among them one will be the one of the "right" file to confirm the offset of it's start sector withing the image.
jaclaz
↧