September 1, 2015

Kali 2 as a long term everyday Linux #3: backup current data using Computer Forensics tools, install Kali2, restore data

Whenever you install Kali2 on a new shining PC or reinstall your old faithful workhorse, it'a a good idea to backup all the PC content, not only the "working" directories. Sure enough, someday you may want to restore something you forgot to backup, such as an old /etc/somekeyfile, /opt/product/registrationkey, or the hidden .bitcoin folder containing the private key you need to became rich in 2030.

A good solution (and a good exercise) for a complete backup is to do a Computer Forensics disk image. This approach has some advantages:
  • The image is compressed and split, but it can be mounted as-is and its contents accessed with read-only guarantee.
  • The backup contains everything, not only your working data. It contains even recently deleted files if you don't zero the free space before the backup (file-carving).
  • An EFF disk image contains integrity checks for each block of data, so the disk can be reconstructed from the good parts in case of damage.
  • You may always restore your disk content someday, as if nothing happened.
  • Nevertheless, it's easy.
See after the break how you can do such a backup and install install Kali Linux 2.0 in 10 easy steps.

Step #1: Power off the PC and boot it using the Kali bootable pendrive.

Step #2: Cleaning the free disk space isn't really necessary, but it reduces the size of the backup and it's easy to get using a single command line:
$ cd && dd if=/dev/nul of=temp.tmp && rm temp.tmp

Step #3: Insert your backup storage disk and ensure there is enough free space.

Step #4: Execute guymager to store in the backup disk (generally NOT /dev/sda) a EWF compressed image of your system disk (generally /dev/sda), split in 2GB chunks to allow storage even on FAT32 disks:


If you're in a hurry you may skip the last two check boxes ("Re-read source..." and "Verify image...").
SHA1 and SHA256 hashes aren't useful in a personal backup, you may skip them.
You can later mount the EWF compressed and split disk image in Kali or other Linux by using the ewfmount command.
With recent consumer equipment (fast sata source disk and usb3 destination disk), disk imaging will last indicatively after four hours for every 1TB of source disk size. Your mileage may vary a lot.

Step #5: Keep the the Kali pendrive inserted and reboot the PC. Then select the graphical (or text) installer.

Step #6: After completing the installation, reboot. The first boot will be slow, don't panic!

Step #7: Login as root (factory password is toor), and:
  1. Set the localized keyboard layout from the settings app (yes, I live in Italy):
    Settings / Region&Language / + / ... / Italian
  2. Change the root password:
    # passwd root
  3. Since login as root is deprecated for everyday use, create an everyday privileged user:
    Settings / Users / Add: Administrator, user1
    or just:
    # useradd -m user1 -G sudo -s /bin/bash
  4. Change the new user password:
    # passwd user1
  5. If for some reason during the installation you selected “no” when asked “use a network mirror” during your Kali installation, you may be missing some entries in your sources.list file. Check it:
    $ sudo nano /etc/apt/sources.list
    Except comments, you should see these three deb active lines, you may copy-paste from here:
    deb http://http.kali.org/kali sana main contrib non-free
    deb http://security.kali.org/kali-security/ sana/updates main contrib non-free
    deb-src http://security.kali.org/kali-security/ sana/updates main contrib non-free
  6. Update the system:
    # apt-get update && sudo apt-get dist-upgrade
Step #8: Logout from root, login as your everyday user to check it works.

Step 9:
$ sudo apt-get clean

Step #10: Reboot, login as your everyday user, enjoy your new Kali2.

If you experience screen brightness dimming issues, try adding acpi_backlight=vendor to the grub command line:
$ sudo leafpad /etc/default/grub
Add acpi_backlight=vendor  to GRUB_CMDLINE_LINUX_DEFAULT, i.e.:
GRUB_CMDLINE_LINUX_DEFAULT="quiet acpi_backlight=vendor"

Proceed with installing some basic tools and applications (stay tuned)