Guided lab: build a disk image, then take it apart

Most disk forensics teaching starts with somebody handing you an image and telling you what is in it. This one starts with you making the image, which means that when you go looking for the deleted file at the end, you already know exactly what you are looking for. Nothing is a surprise, and that is the point: you are checking the tools against ground truth you set yourself.

Twenty minutes, and about 70MB of disk. Everything you need was installed by the provisioner on the lab machine page.

What you need

A VM running Ubuntu 24.04 or Debian 12 with the toolkit installed, and a snapshot you can roll back to. sleuthkit, parted and dosfstools are the three that matter here.

Everything below runs in ~/lab/evidence. Nothing touches a real disk: you are working inside a file, attached to a loop device, and the last step detaches it.

Build the volume

cd ~/lab/evidence

# a 64MB file that will pretend to be a disk
dd if=/dev/zero of=case01.raw bs=1M count=64 status=progress

# one FAT32 partition, starting at the conventional 1MiB offset
parted -s case01.raw mklabel msdos
parted -s case01.raw mkpart primary fat32 1MiB 100%

# attach it, so the kernel exposes the partition as a block device
LOOP=$(sudo losetup -fP --show case01.raw)
echo "attached as $LOOP"

sudo mkfs.vfat -F 32 -n EVIDENCE "${LOOP}p1"

losetup -fP finds the first free loop device and scans the partition table, so you get /dev/loopNp1 as well as /dev/loopN. The -P is the part people forget, and without it the partition never appears.

Put something on it, then delete it

sudo mkdir -p /mnt/case01
sudo mount "${LOOP}p1" /mnt/case01

# three files, one of which is about to have a bad day
echo "quarterly figures, final version" | sudo tee /mnt/case01/report.txt
echo "notes from the call on tuesday"   | sudo tee /mnt/case01/notes.txt
echo "SECRET-CANARY-7F3A2B please do not exfiltrate me" \
  | sudo tee /mnt/case01/payroll.txt

sudo sync
sudo rm /mnt/case01/payroll.txt
sudo sync

sudo umount /mnt/case01
sudo losetup -d "$LOOP"

The canary string in the third file is there so you can prove, later, that what you recovered is the file you deleted and not something that merely looks like it.

Read the layout

mmls case01.raw

Every Sleuth Kit tool that reads a filesystem needs to be told where that filesystem starts, because a raw image has no idea. That is what -o does, and forgetting it is the single most common beginner error with these tools.

fsstat -o 2048 case01.raw | head -30

Find what is still there

fls -o 2048 -r case01.raw

Recover it

Take the inode number fls printed for the deleted entry, and read the content straight out of the image.

# replace 5 with the number fls gave you
icat -o 2048 case01.raw 5

blkls -o 2048 case01.raw > unallocated.bin
ls -lh unallocated.bin
strings unallocated.bin | grep -i canary

What to take from this

You have now done, on a volume you built, the four moves that every disk examination starts with: find the partition, identify the filesystem, list what is there including what has been deleted, and pull content out by inode without mounting anything.

The reasoning transfers directly. What does not transfer is the certainty: you knew the answers before you started, and on a real image you will not. That is what the artifact reference is for, and it is why the entries there each say what an artifact does not prove.

Clean up

# check nothing is still attached before you roll back
losetup -a
sudo rm -f ~/lab/evidence/case01.raw ~/lab/evidence/unallocated.bin

Then restore your snapshot, which is the habit worth building more than any of the commands above.