In this tutorial we will take alook on how to recover your deleted files from a usb stick or an external hard drive by using forensic tools installed on your debian based operating systems.

for this tutorial we will take alook at 2 tools <recoverjpeg> & <foremost>, those tools are needed to recover jpeg images, mp4 videos, pdf files, text files, ... etc.

installation:

In order to start recovering your deleted data we will start by installing the tools needed:

Step 1: Updating & upgrading your system.

~$ sudo apt-get update && sudo apt-get upgrade 

Step 2: Installing recoverjpeg

~$ sudo apt-get install recoverjpeg 

Step 3: Installing foremost

~$ sudo apt-get install foremost

Usage:

Now as we installed the tools needed we start using it

.

Step 1: We need to create the folder that will contain the output of the recovery proccess, we will create it on the Desktop as so

~$ cd Desktop/

~$ makedir recover

Step 2: Using recoverjpeg

Here we will take alook on how to use recoverjpeg

Insert your usb or external hard drive, in order to find it type the following command

~$ sudo fdisk -l

this command will show you the mounted devices into your computer. Find the device you want to recover data from and copy it's name.

go to the terminal and type the following to use recoverjpeg

~# sudo recoverjpeg /dev/sdb1 -o /home/user/Desktop/recover/

Note: 

/dev/sdb1 ---> the mounted device location

-o        ---> The output location

This tool used to recover JPEG Images.

Step 3: Using foremost

Now we will use foremost tool to recover video files,images,pdf's,txt's, ... etc.

Type the following command:

~$ sudo foremost -t all -v -i /dev/sdb1 -o /home/user/Desktop/recover/

Note:

-t        ---> The files typies needed to recover.(instead of all you can weite jpeg,mp4,pdf)

-v        ---> View proccess

-i        ---> Inserted device location

-o        ---> The output location

That's all for this tutorial.

Follow me @ zaidjaber

Thanks for the support

Category: How To