Lion Cipher Lab
Recover deleted files from your own test disk
- Digital Forensics & IR (DFIR)
- Beginner
- ~40 min
- Free · no account required
Why it matters
"I deleted it, so it's gone" is one of the most expensive assumptions in security, and it is usually wrong. On ordinary filesystems, deleting a file removes the directory entry that points to it and marks its blocks as free — but the actual data stays on the disk until some later write happens to land on top of it. That single fact cuts two ways, and a defender needs both. On the recovery side, it means files thought lost to an accidental delete, a reformatted card, or a struggling drive can often be pulled back with free tools — a genuine day-one DFIR and IT-support skill. On the privacy…
What you'll learn
- how deletion really works
- file carving
- disk imaging with dd
- recovery with PhotoRec/TestDisk
- recovery with foremost
- secure erasure (why overwrite matters)
- media sanitization basics
Steps in this lab
- The one rule, and why a deleted file usually isn't gone
- Build a throwaway disk image you own
- Put a few files on it, then delete them
- Meet the recovery tools: PhotoRec and TestDisk
- Carve your files back with PhotoRec
- Do it again the fully automatic way with foremost
- The other half of the lesson: real erasure means overwriting
- What you actually learned to feel, not just know