Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Recovering files without password

“Spartans! Ready your breakfast and eat hearty… For tonight, we dine in hell!”
~ King Leonidas [300]

It was with great enthusiasm, to justify the username of my linux machine - “curiouscat”, that I set forth on the adventure to bring a revolutionary linux application on my unsuspecting Ubuntu machine. It had worked on a air gapped Kali machine so it should work with some quirks, right? RIGHT?!

Step 1: Prioritize what you want back

No. Long story short the AI suggested I play around with MOK keys and one sudo command leads to another until I try rebooting and….well nothing. The screen froze. It just wouldn’t boot. Maybe I should reconsider AI output which leads to reboot and tampering with boot files.
After a ton of trying to remounting the partition, figuring out where the boot fails, I decide it isn’t worth the effort. Having just my study notes and a few pictures back is all I care about.

Step 2: Buy/Borrow/Burglarize a usb drive

We are going to access what’s in SSD using a USB. The idea is to boot something quick enough to play with files on SSD.
Among many good options to burn iso files, like Rufus[1], I’d suggest you install Ventoy[2] from sourceforge.

tar xvf ventoy-1.1.12-linux.tar.gz
cd ventoy-1.1.12-linux
# Have the USB plugged in
sudo ./VentoyGUI.x86_64

Select your USB and install ventoy. Now all you need to do is copy-paste Linux iso files into it to run the OS you feel like.

Step 3: Boot a fresh OS from USB

Disable secure boot just to avoid any trouble later. Google how to get into BIOS setting for your laptop and goto security->secure boot: disable.
In the same manner press the key required to get you to the boot menu (F9 for my Lenovo) and select your USB to boot the OS from. Checkout this blog[3] to have persistence some other day.
I downloaded Fedora and Ubuntu iso from their official sites.
Let’s use Fedora for recovery.

Skip the prompt for installation and head straight for file manager. Thy precious’s file manager had his 500gb SSD listed in the aside panel. But just in case you didn’t find it,

ls /run/media/<hash>/
# Your SSD must be mounted somewhere here.

If your ssd is however not mounted for some reason, proceed to check which partition has the files you want and mount it

lsblk
# Look for mountpoints that has '/'

NAME        MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
nvme0n1     259:0    0 476.9G  0 disk 
|-nvme0n1p1 259:1    0     1G  0 part /boot/efi
`-nvme0n1p2 259:2    0 475.9G  0 part /  

sudo mkdir /mnt/ssd
sudo mount /dev/nvme0n1p2 /mnt/ssd
# Now the files must be visible from /mnt/ssd
# Unmount with sudo umount -f /mnt/ssd

Viola! Now we can visit the files on disk through /run/media/78asd-hash-something/home/user/ or /mnt/ssd/home/user/.

Step 4: Saving (rescue)

Let me remind you that you’re using an OS from a 32gb Flash drive. There is no persistence so copy pasting everything into “this OS” will give you nothing.

zip -r SaveThese.zip StudyNotes/ Pictures/ 
mv SaveThese.zip ~/Downloads

Connect to the internet and ideally upload files in chunks to your online drive. Having zipped files in “Downloads” folder helps not navigating too deep.

That’s it. You have successfully penetrated inside a PC to recover files you thought were lost forever.

References

1. Rufus
2. Ventoy
3. Create Persistent Bootable USB Using Ventoy In Linux