Recover Deleted Files with Sleuth Kit

Recovering Deleted Files Using Sleuth Kit

Accidentally deleting important files can feel like a disaster, but with tools like Sleuth Kit (Official site), you can often recover those files. Sleuth Kit is a powerful open-source suite used for forensic analysis of digital media, perfect for retrieving lost data effectively. In this tutorial, we’ll guide you through the process of using Sleuth Kit to recover deleted files.

Prerequisites

A computer with Linux, Windows, or macOS installed.
Sleuth Kit installed on your device. Read our installation guide for Sleuth Kit.
Basic familiarity with command-line interface.

Step-by-Step Instructions

1. Identify the File System

Before you can recover your files, identify the file system type of the drive containing the deleted files. Common file systems include NTFS, FAT, exFAT, and ext.

2. Use the ‘fls’ Command

Begin by using the fls command to list the contents of the file system. This command helps identify deleted files:

fls -r /dev/sdX1

Replace /dev/sdX1 with your specific drive identifier. You’ll see entries with \* or d/d, indicating deleted files.

3. Extract Deleted Files with ‘icat’

For file recovery, use the icat command which reads and copies the file content to a new location:

icat /dev/sdX1 1234 > recovered_file.jpg

Replace 1234 with the inode number obtained from the fls output and recovered_file.jpg with your desired file name.

4. Verify File Recovery

After recovering, check the file integrity. Open the recovered file with appropriate software to ensure data wasn’t corrupted.

Troubleshooting

File Not Found Error: Ensure you have input the correct inode number.
Corrupted File: Try recovering with different inode numbers if available.

Summary Checklist

Ensure Sleuth Kit is correctly installed.
Identify the file system type.
List files using the fls command.
Recover files with icat.
Verify the integrity of recovered files.

Recovering deleted files using Sleuth Kit can be a straightforward process when you know the steps. This tool not only aids in data recovery but also empowers users to perform basic forensic analysis on their systems. For more advanced forensic analysis, consider using Autopsy for forensic analysis as it offers a GUI version of Sleuth Kit’s functionalities.