Recover Deleted Files on Linux | Sleuth Kit Ext4 Demo

Hands-on demo: learn how to recover deleted files from an ext4 disk image using The Sleuth Kit on Parrot OS; step-by-step, safe, and practical for Linux users and hobbyist forensics. https://www.sleuthkit.org/ https://linuxleo.com/ Rocky Linux Supported by CIQ: https://ciq.com/products/rocky-linux/ CompTIA Linux+ Certifcation Course https://youtu.be/qNxuTRCRjoQ Remember to Like, Share, and Subscribe if you enjoyed the video! Also, if you are interested in more Linux content, please consider becoming a channel member so I can continue to produce great content! ✔️RECOMMENDED LINUX BOOKLIST ------------------------------- Linux Pocket Guide: Essential Commands: https://amzn.to/3xGPvsK CompTIA Linux+ Certification All-in-One Exam Guide: Exam XK0-004 https://amzn.to/3uQ3wmh 101 Labs - CompTIA Linux+ https://amzn.to/3vtj7rb How Linux Works: What Every Superuser Should Know https://amzn.to/3vrLkOO Linux Bible https://amzn.to/3rwEkPH ✔️SOCIAL NETWORKS ------------------------------- KeepItTechie: https://keepittechie.com/ Facebook: https://www.facebook.com/KeepItTechie Twitter: https://twitter.com/keepittechie Instagram: https://www.instagram.com/keepittechie/ Discord: https://discord.gg/RjZWuyd -------------------------------- ✔️RECORDING EQUIPMENT ------------------------------- Insta360 4K Webcam - https://amzn.to/3RddfgZ Rode Procaster Microphone - https://amzn.to/42RSInF RØDE RØDECaster Duo - https://amzn.to/4ct1T1X Cloudlifter CL-1 Mic Activator - https://amzn.to/4ic7BXv Logitech LED Streaming Light - https://amzn.to/4j7Z8FT -------------------------------- Important: I did not extract or view potentially illegal files. I only inspected metadata (istat) and documented it. If you’re doing real work, preserve evidence and contact legal/authorities where appropriate. 0:00 Intro — Josh 1:01 What is The Sleuth Kit (TSK) 3:12 LinuxLEO & Able3 image 3:57 Why Parrot OS & Sleuth Kit install note 4:01 Create workspace & download Able3 6:01 Verify archive (checksum) & extract image 8:03 Image metadata with img_stat 9:55 Partition table with mmls — pick offset 12:04 Verify filesystem with fsstat (ext4) 14:47 Enumerate files with fls (full + deleted) 17:55 Inspect inode with istat & carve with icat 22:12 Demonstrate deleted inode behavior (ext4) 24:30 Triage with tsk_recover (folder-style) 25:30 Documentation & case notes (checksums) 26:30 Wrap-up what we learned 27:14 Career pep talk / final encouragement