One of the questions for Linux users is probably if there are any programs like Recover My File on Windows for Kali Linux? Is it possible to recover deleted files on Kali Linux if we have no backup files? Fortunately, in the process of data recovery on Linux, like Windows, there are many free and powerful tools that we can use to recover deleted files on Kali Linux.
Basically, no information on your system will be deleted on its own, unless you delete it yourself. This deletion may be due to your ignorance. Because a very simple command in the command shell (rm) can easily delete your data and the only thing we can do in this situation is to look at the system command shell black screen.
How to Recover Deleted Files on Kali Linux?
Before going any further, you must log in with the root user. If you are using the basic user, you will run into problems later. Also, for this article, I will recover deleted files from USB flash drive, however, you can use the same method to recover data from drives inside Kali Linux.
archyde news
archyde news
Step 1. Open the terminal and go to the desktop and create a new directory using the mkdir on the desk. In my case, the directory I create is called “recovers”. Once the directory is created, reveal the same directory using the cd command.
2nd step. The tool by which I will recover deleted files is known as Foremost, so please install it using the following command on the terminal.
Sudo apt install ForemostStep 3. Now I will find the path or, to put it simply, the location of the USB drive. Just type the following command, and at the end you will see it, just copy the path.
fdisk -lLook at the codes below in the code snippet, the last two lines of the following code is the path of the USB flash drive and it is /dev/sdb1, you need to copy it.
┌──(root????kali)-[/home/kali/Desktop/recovers]
└─# fdisk -l
Disk /dev/sda: 80 GiB, 85899345920 bytes, 167772160 sectors
Disk model: VMware Virtual S
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x3fbdf554
Device Boot Start End Sectors Size Id Type
/dev/sda1 * 2048 165771263 165769216 79G 83 Linux
/dev/sda2 165773310 167770111 1996802 975M 5 Extended
/dev/sda5 165773312 167770111 1996800 975M 82 Linux swap / So
Disk /dev/sdb: 15.23 GiB, 16357785600 bytes, 31948800 sectors
Disk model: Flash Disk
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: D4FC65D6-0839-4A5B-BE7F-F90EFDA6EEE5
Device Start End Sectors Size Type
/dev/sdb1 2048 31946751 31944704 15.2G Microsoft basic data
Step 4. Once you have found the path to the USB flash drive, we need to find the most important command attributes. Cone First of all – help and press enter.
┌──(root????kali)-[/home/kali/Desktop/recovers]
└─# foremost -help
foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus.
$ foremost [-v|-V|-h|-T|-Q|-q|-a|-w-d] [-t ] [-s ] [-k ]
[-b ] [-c ] [-o ] [-i <file]
-V - display copyright information and exit
-t - specify file type. (-t jpeg,pdf ...)
-d - turn on indirect block detection (for UNIX file-systems)
-i - specify input file (default is stdin)
-a - Write all headers, perform no error detection (corrupted files)
-w - Only write the audit file, do not write any detected files to the disk
-o - set output directory (defaults to output)
-c - set configuration file to use (defaults to foremost.conf)
-q - enables quick mode. Search are performed on 512 byte boundaries.
-Q - enables quiet mode. Suppress output messages.
-v - verbose mode. Logs all messages to screen
┌──(root????kali)-[/home/kali/Desktop/recovers]
└─#
To recover each type of file, we need to add the -t attribute followed by “everything“. If you want to recover only jpeg or png or any other type of file, just instead of “everything” tapered.
I also use the -v (means verbose), –o (represents output directory) and -i (insert USB drive path).
To combine all attributes together it will be Foremost -t all -i /dev/sb1 -v -o /root/Desktop/recovers/
After the files are retrieved, you bundle directories into the output directory you mentioned.
Conclusion:
It is not really difficult to recover deleted files on Kali Linux, you just need to have root privileges. Then install Foremost tool and finally combine attributes and recover deleted files. I hope this article has helped you.
If the article is confusing, you can watch the video below.
https://youtu.be/Gc_bfvOanqc