How Police Recover Deleted Files | Sleuth Kit on Kali Linux

Published at : 23 Dec 2025

🔍 Enjoying this video? There’s more where that came from! Dive deeper into digital forensics with the full playlist:
https://www.youtube.com/playlist?list=PLbLfGhJtu3KmxcYiqGXTlgXOQC949wCDb

💚 Support the Channel
Your support helps me keep creating valuable content. Consider supporting me here:
https://www.youtube.com/channel/UC17VZx3ERdQsNvAvXQYjKKw/join

🏬 Fresh Forensics Store:
https://t10fpe-zh.myshopify.com

😎 Welcome to my channel!
If you're looking to enhance your skills in Linux, tech, and more, you're in the right place! 🎥

🌐 Android Forensics Github
https://github.com/DouglasFreshHabian/AndroidForensics

🔍 In this video, we dive into the world of digital forensics to uncover hacker secrets using Kali Linux and powerful tools like The Sleuth Kit and ewf-tools. We walk through real-world forensic techniques employed by law enforcement to identify, analyze and recover evidence from disk images. We will learn how to recover deleted files from disk images using command-line utilities such as mmls, fsstat, and fls in Kali Linux's pre-installed forensics suite. The tutorial involves practical exercises, such as downloading and extracting disk images, generating file hashes, and leveraging tools to examine and recover files, with a particular focus on a Linux-based forensic approach.

𓃥 Sleuth Kit
https://sleuthkit.org

👮 Linux LEO
https://linuxleo.com

📂 Ext2 Disk Image
https://linuxleo.com/Files/able2.tar.gz

🎶 Music Credits
🔹 Music is provided by Chosic under the Creative Commons CC BY-SA 3.0 License

📢 Disclaimer
This video is for educational purposes only.

🔑 Timestamps:
00:00 - Introduction & Overview
00:37 - Overview of Sleuth Kit Tools
03:31 - Referencing LinuxLeo.com
07:00 - Downloading Supplemental Files (wget)
07:55 - Hashing Supplemental File (sha1sum)
07:00 - Downloading Supplemental Files (wget)
08:27 - Decompressing & Extracting Files
10:15 - Display Partition Layout of Image (mmls)
11:48 - Print General Details of File System (fsstat)
12:42 - List File & Directory Names In Filesystem (fls)
14:07 - Viewing Hidden Files (fls)
15:10 - Recover Deleted Files (fls)
17:08 - View Contents of File Using icat & Display
19:54 - Outro