I've tried your test wallet and got an offset for file location - any hints on how to get the wallet's content, with dd i presume?
Basically, what is at that offset is (remnants of) a Berkeley DB file; you'll need manually do the forensic work to get the key out of it past that. Alternatively, there are services that will recover locked/corrupted wallet files I think, so you could extract a big blob around that byte offset and find someone that will do the forensic work for you.