How to Recover Deleted Files on Kali Linux?

Probably one of the questions for Linux users is whether there are programs like recover my file on Windows for Kali Linux? Is it possible to Recover Deleted Files on Kali Linux if we do not have any backup files? Fortunately, in the process of data recovery in Linux, like Windows, there are many free and powerful tools that we can use to Recover Deleted Files on Kali Linux.

Basically, no information on your system will be deleted by itself, unless you delete it yourself. This deletion may be due to your ignorance. Because a very simple command in the command environment (rm) can easily delete your data and the only thing we can do in this situation is to stare at the black screen of the system command environment.

How to Recover Deleted Files on Kali Linux?

Before going a step further, make sure that you log in with the Root user. If you use the basic user, later you will face some issues. Also, for this article I am going to recover deleted files of a USB flash drive, however, you can use the same method to recover data from the drives inside the Kali Linux.

Step #1. Open the terminal and go to the desktop and create a new directory using the mkdir on the desktop. In my case, the directory that I create is called “recovers”. Once you create the directory, go to the same directory using the cd command.

Create a New Directory

Step #2. The tool by which I am going to recover the deleted files is known as Foremost, so make sure you install it using the following command on the Terminal.

Sudo apt install Foremost

Install Foremost on Kali Linux

Step #3. Now I am going to find out the path or to put it simply the location of the USB flash drive. Just type the following command, and in the end, you will see it, just copy the path.

fdisk -l

Look at the below codes in the snippet, the last two lines in the following code are the path of the USB flash drive and it is /dev/sdb1, make sure you copy it.

┌──(root💀kali)-[/home/kali/Desktop/recovers]
└─# fdisk -l                                                 


Disk /dev/sda: 80 GiB, 85899345920 bytes, 167772160 sectors
Disk model: VMware Virtual S
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x3fbdf554

Device     Boot     Start       End   Sectors  Size Id Type
/dev/sda1  *         2048 165771263 165769216   79G 83 Linux
/dev/sda2       165773310 167770111   1996802  975M  5 Extended
/dev/sda5       165773312 167770111   1996800  975M 82 Linux swap / So


Disk /dev/sdb: 15.23 GiB, 16357785600 bytes, 31948800 sectors
Disk model: Flash Disk      
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: D4FC65D6-0839-4A5B-BE7F-F90EFDA6EEE5

Device     Start      End  Sectors  Size Type
/dev/sdb1   2048 31946751 31944704 15.2G Microsoft basic data

The USB flash drive Path

Step #4. Once you find out the USB flash drive’s path, we need to find the attributes of the foremost command. Type Foremost -help and press enter.

┌──(root💀kali)-[/home/kali/Desktop/recovers]
└─# foremost -help                                           
foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus.
$ foremost [-v|-V|-h|-T|-Q|-q|-a|-w-d] [-t <type>] [-s <blocks>] [-k <size>] 
        [-b <size>] [-c <file>] [-o <dir>] [-i <file] 

-V  - display copyright information and exit
-t  - specify file type.  (-t jpeg,pdf ...) 
-d  - turn on indirect block detection (for UNIX file-systems) 
-i  - specify input file (default is stdin) 
-a  - Write all headers, perform no error detection (corrupted files) 
-w  - Only write the audit file, do not write any detected files to the disk 
-o  - set output directory (defaults to output)
-c  - set configuration file to use (defaults to foremost.conf)
-q  - enables quick mode. Search are performed on 512 byte boundaries.
-Q  - enables quiet mode. Suppress output messages. 
-v  - verbose mode. Logs all messages to screen
                                                                      
┌──(root💀kali)-[/home/kali/Desktop/recovers]
└─# 

To recover every type of file, we need to add the -t attribute following by “all“. If you want to recover only jpeg or png or any other type of file, just instead of “all” type it.

I am also using the -v (stands for verbose), – o (Stands for output directory), and -i ( insert the USB drive’s path).

To combine all the attributes together, it will be Foremost -t all -i /dev/sb1 -v -o /root/Desktop/recovers/

Recover the deleted files using the Foremost command

Once the files are recovered, you will bunch of directories in the output directory you mentioned.

Recovered Files

Conclusion:

It is not really hard to Recover Deleted Files on Kali Linux, just make sure you have the root privileges. Then install the Foremost tool and finally combine the attributes and recover the deleted files. I hope this article helped you.

If the article is confusing, you can watch the below video.

https://youtu.be/Gc_bfvOanqc