Probably one of the questions for Linux users is whether there are programs like recover my file on Windows for Kali Linux? Is it possible to Recover Deleted Files on Kali Linux if we do not have any backup files? Fortunately, in the process of data recovery in Linux, like Windows, there are many free and powerful tools that we can use to Recover Deleted Files on Kali Linux.
Basically, no information on your system will be deleted by itself, unless you delete it yourself. This deletion may be due to your ignorance. Because a very simple command in the command environment (rm) can easily delete your data and the only thing we can do in this situation is to stare at the black screen of the system command environment.
How to Recover Deleted Files on Kali Linux?
Before going a step further, make sure that you log in with the Root user. If you use the basic user, later you will face some issues. Also, for this article I am going to recover deleted files of a USB flash drive, however, you can use the same method to recover data from the drives inside the Kali Linux.
Step #1. Open the terminal and go to the desktop and create a new directory using the mkdir on the desktop. In my case, the directory that I create is called “recovers”. Once you create the directory, go to the same directory using the cd command.
Step #2. The tool by which I am going to recover the deleted files is known as Foremost, so make sure you install it using the following command on the Terminal.
Sudo apt install Foremost
Step #3. Now I am going to find out the path or to put it simply the location of the USB flash drive. Just type the following command, and in the end, you will see it, just copy the path.
Look at the below codes in the snippet, the last two lines in the following code are the path of the USB flash drive and it is /dev/sdb1, make sure you copy it.
┌──(root💀kali)-[/home/kali/Desktop/recovers] └─# fdisk -l Disk /dev/sda: 80 GiB, 85899345920 bytes, 167772160 sectors Disk model: VMware Virtual S Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x3fbdf554 Device Boot Start End Sectors Size Id Type /dev/sda1 * 2048 165771263 165769216 79G 83 Linux /dev/sda2 165773310 167770111 1996802 975M 5 Extended /dev/sda5 165773312 167770111 1996800 975M 82 Linux swap / So Disk /dev/sdb: 15.23 GiB, 16357785600 bytes, 31948800 sectors Disk model: Flash Disk Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: gpt Disk identifier: D4FC65D6-0839-4A5B-BE7F-F90EFDA6EEE5 Device Start End Sectors Size Type /dev/sdb1 2048 31946751 31944704 15.2G Microsoft basic data
Step #4. Once you find out the USB flash drive’s path, we need to find the attributes of the foremost command. Type Foremost -help and press enter.
┌──(root💀kali)-[/home/kali/Desktop/recovers] └─# foremost -help foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus. $ foremost [-v|-V|-h|-T|-Q|-q|-a|-w-d] [-t <type>] [-s <blocks>] [-k <size>] [-b <size>] [-c <file>] [-o <dir>] [-i <file] -V - display copyright information and exit -t - specify file type. (-t jpeg,pdf ...) -d - turn on indirect block detection (for UNIX file-systems) -i - specify input file (default is stdin) -a - Write all headers, perform no error detection (corrupted files) -w - Only write the audit file, do not write any detected files to the disk -o - set output directory (defaults to output) -c - set configuration file to use (defaults to foremost.conf) -q - enables quick mode. Search are performed on 512 byte boundaries. -Q - enables quiet mode. Suppress output messages. -v - verbose mode. Logs all messages to screen ┌──(root💀kali)-[/home/kali/Desktop/recovers] └─#
To recover every type of file, we need to add the -t attribute following by “all“. If you want to recover only jpeg or png or any other type of file, just instead of “all” type it.
I am also using the -v (stands for verbose), – o (Stands for output directory), and -i ( insert the USB drive’s path).
To combine all the attributes together, it will be
Foremost -t all -i /dev/sb1 -v -o /root/Desktop/recovers/
Once the files are recovered, you will bunch of directories in the output directory you mentioned.
It is not really hard to Recover Deleted Files on Kali Linux, just make sure you have the root privileges. Then install the Foremost tool and finally combine the attributes and recover the deleted files. I hope this article helped you.
If the article is confusing, you can watch the below video.