Home / ubuntu / Questions / 1291578
In Process
JJrussel
Asked: 2020-11-12 16:17:22 +0800 CST

Is there a way to recover a file created in a live USB session?

  • 772

I saved a text file on the desktop while booted in non-persistent Xubuntu 20.04 LTS live USB created with UNetbootin.

Naturally that file was gone when I restarted the computer and booted back into live Xubuntu.

Given that files are never really %100 deleted and parts of it will be saved in several places, what are my chances of recovering the file (or any part of it) if - hypothetically - I had all the resources needed to do the job?

security live-usb data-recovery xubuntu

1 Answers

  1. The file was only stored in memory (dynamic RAM). Yes you may save files and store them on a fs (file-system) but that file-system was created in RAM itself, and not on disk or other more permanent storage.

    It'll need a program to scan memory looking for it. On restart the next booted OS will use RAM overwriting whatever was there before hand without regard, programs can malloc() (memory allocate) that ram & scan to see/save what was in it (why some security-based live systems offer the choice of delaying shutdown by a number of minutes to overwrite RAM so nothing is left behind, Xubuntu doesn't offer that as few want it)

    On turning the machine off, without refreshes dram will lose it's contents in 3-22 secs (depending on temperature & environment, though that can be extended by use of liquid nitrogen to cool ram chips) but again you need to be prepared..

    Effectively it's lost. The file-system it was stored to existed only in memory/ram unless you mounted a non-volatile file-system, or scp or copied it before shutdown.

    • 0