Disk forensics_Recovering Deleted Files (ext4)

Why this works

rm only removes the directory entry and marks the inode/blocks as free — it does not erase the actual data. Until those blocks get overwritten by something else, the content is still recoverable.

Workflow

1. Identify the image

file image.img

Tells you the filesystem type and whether it’s a raw filesystem or a full disk (with a partition table).

2. Check for a partition table

mmls image.img

• If it returns partitions → note the offset (in sectors) of the one you want, multiply by sector size for -o.
• If it returns nothing / errors → the image is likely a raw filesystem already (no partition table), so skip the offset entirely.

3. Confirm filesystem details

fsstat image.img                  # no partition table
fsstat -o <offset> image.img      # if there was a partition table

4. List files, including deleted ones

fls -r -d image.img

• -r = recurse into subdirectories
• -d = show only deleted entries
• Drop -d to see everything (deleted + live) together

Output lines starting with * are deleted entries. Format:

* r/r * <inode>(realloc):   path/to/file

• The number before (realloc) (or without it) is the inode.
• (realloc) means the inode metadata has been reused since deletion — data might be partially overwritten, but often still intact.

5. Recover by inode

icat image.img <inode> > recovered_file
# or, if the inode needs recovery mode:
icat -r <inode> image.img > recovered_file

icat reads content directly from disk blocks by inode number — it doesn’t care that the filename/directory entry is gone.

6. Verify what you got

file recovered_file
cat recovered_file        # if text

If fls/icat don’t find it or content is corrupted

Fall back to raw carving (scans for file signatures, ignores filesystem metadata entirely):

foremost -i image.img -o output_dir/
scalpel image.img -o output_dir/
photorec image.img

Quick brute-force check

Sometimes faster than a full workflow — just grep the whole raw image for a known string pattern:

strings image.img | grep -i "FLAG{"

Tool cheat sheet

Tool	Purpose
file	Identify image/filesystem type
mmls	Show partition table & offsets
fsstat	Filesystem details (confirm ext4, block size, etc.)
fls -r -d	List deleted files + their inode numbers
icat	Extract file content directly by inode
foremost / scalpel / photorec	Raw signature-based carving when metadata is gone
strings + grep	Quick blind search for plaintext flags/strings

All of these come from The Sleuth Kit (TSK) except foremost/scalpel/photorec, which are separate carving utilities — install with apt install sleuthkit foremost scalpel testdisk on Kali/Debian.