Hello everyone, today I would like to share this article with you guys, because most of us, and I am one of them, delete or format drive unexpectedly. For this post, I have 64GB USB drive that formatted as FAT32.
=> Linux operating system (Kali).
=> USB, internal or external disk that has deleted files.
For this post, I am not going to explain the theory behind it and why we are able to retrieve the deleted files. However, I will walk you through the steps to recover all deleted files practically!
I am going to use Kali Linux as the main machine that will retrieve the data. You can use other operating systems. The first step is to check the full path of the sub drive name on the system by using the following command:
Using lsblk command, we could identify all drives that have been connected to the computer. As obvious, my USB drive has sdb as a disk, and sdb1 as a partition. Therefore, the full path will be /dev/sdb if you would like to recover all deleted files from the entire disk. Other cases, it could have more than partitions such as sdb1 and sdb2. In my case, I will use sdb1 because it represents the entire disk.
Another way to know the full path by using fdisk command:
Next, I am going to make an exact copy of my USB drive into my Kali Linux using the forensics tools such as dd, dc3dd and other. dd is a tool that copies bit-by-bit from the destination! dc3dd is an advanced tool that based on dd command, and it has many forensics features such as log, hash, wipe and others. I will be using dc3dd to create an exact copy of my USB to my Desktop using the following command:
Please be careful when you using such these tools, because if you don’t know how to deal with them, you may lose and delete your files!!!
Usually, for integrity, we calculate the md5 hash for the source and destination disk, but for now, it will take time since it has 64 GB, and it could take a while.
Now, I will be using the usb.dd and try to recover some files, but first, I would like to mount the drive to the system and check if there are any files.
Next, I will be using foremost to recover all kind of files including jpg,png,exe,pdf, and more others.
As you can see, the result is fantastic; I have successfully recovered deleted files.
Many tools could do the task. You can search for them using Google or any security websites. For example, Kali Linux has many forensics tools such as recoverjpeg for recovering the jpeg files only and recovermov for .mov files.
I hope you enjoy the article and getting something new! Thank you!