Deleted File Recovery

When a file is deleted, the data doesn't disappear. The filesystem marks the space as available, but the actual bytes remain on disk until they're overwritten. Recovery tools scan for these orphaned bytes and reconstruct the files.

In CTF challenges, the disk image is a forensic snapshot — nothing gets overwritten, so recovery almost always works.

How Deletion Works

The data is recoverable until the disk space is reused by new files.

Recovery Workflow

Recovery Steps

sudo apt install testdisk
photorec disk.img
# Interactive: select disk → partition → filesystem → output dir → start

sudo apt install sleuthkit
fls -rd disk.img | grep "deleted"
# Output: d/d * 45: secretfile.txt  (asterisk = deleted)

icat disk.img 45 > recovered_secretfile.txt
cat recovered_secretfile.txt

blkls disk.img > unallocated.bin
strings unallocated.bin | grep -i "flag{"
grep -a "flag{" unallocated.bin

Tool Guide

sudo apt install testdisk   # photorec included
photorec disk.img
# 1. Select disk (disk.img)
# 2. Select partition / whole disk
# 3. Choose filesystem type
# 4. Select output directory
# 5. Start recovery

Special Cases

Checklist

• photorec disk.img → recover all files automatically
• testdisk → recover partition tables and deleted files interactively
• fls -rd disk.img → list deleted files with inodes
• icat disk.img <inode> → recover specific deleted file
• strings disk.img | grep flag → raw string search
• blkls + strings for unallocated space
• ntfsundelete for Windows NTFS disk images
• debugfs + lsdel for ext4 inode inspection
• Check for deleted .git directories and SQLite databases

Last updated on Aug 1, 2025