Setting Up Unencrypted Persistence on a USB Key from the Kali Linux Guide by OnWorks

Skip to content

9.4.2. Setting Up Unencrypted Persistence on a USB Key‌‌

In this section, we assume that you have prepared a Kali Live USB Key by following the instructions at section 2.1.4, “Copying the Image on a DVD-ROM or USB Key” [page 19] and that you have used a USB key big enough to hold the ISO image (roughly 3 GB) and the data of the directories that you want to persist. We also assume that the USB key is recognized by Linux as /dev/sdb and that it only contains the two partitions that are part of the default ISO image (/dev/sdb1 and /dev/sdb2). Be very careful when performing this procedure. You can easily destroy important data if you re-partition the wrong drive.

To add a new partition, you must know the size of the image that you copied so that you can make the new partition start after the live image. Then use parted to actually create the partition. The commands below analyze the ISO image named kali-linux-2016.1-amd64.iso, which is assumed to be present on the USB key as well:

# parted /dev/sdb print

Model: SanDisk Cruzer Edge (scsi) Disk /dev/sdb: 32,0GB

Sector size (logical/physical): 512B/512B Partition Table: msdos

Disk Flags:

Number Start End Size Type File system Flags

1 32,8kB 2852MB 2852MB primary boot, hidden

2 2852MB 2945MB 93,4MB primary

# start=$(du --block-size=1MB kali-linux-2016.1-amd64.iso | awk ’{print $1}’)

# echo ”Size of image is $start MB”

Size of image is 2946 MB

# parted -a optimal /dev/sdb mkpart primary ”${start}MB” 100%

Information: You may need to update /etc/fstab.

# parted /dev/sdb print

Model: SanDisk Cruzer Edge (scsi) Disk /dev/sdb: 32,0GB

Sector size (logical/physical): 512B/512B Partition Table: msdos

Disk Flags:

Number Start End Size Type File system Flags

1 32,8kB 2852MB 2852MB primary boot, hidden

2 2852MB 2945MB 93,4MB primary

3 2946MB 32,0GB 29,1GB primary

With the new /dev/sdb3 partition in place, format it with an ext4 filesystem labelled “persistence” with the help of the mkfs.ext4 command (and its -L option to set the label). The partition is then mounted on the /mnt directory and you add the required persistence.conf configuration file. As

always, use caution when formatting any disk. You could lose valuable information if you format the wrong disk or partition.

# mkfs.ext4 -L persistence /dev/sdb3

mke2fs 1.43-WIP (15-Mar-2016)

Creating filesystem with 7096832 4k blocks and 1777664 inodes Filesystem UUID: dede20c4-5239-479a-b115-96561ac857b6 Superblock backups stored on blocks:

32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,

4096000

Allocating group tables: done Writing inode tables: done

Creating journal (32768 blocks): done

Writing superblocks and filesystem accounting information: done

# mount /dev/sdb3 /mnt

# echo ”/ union” >/mnt/persistence.conf

# ls -l /mnt

total 20

drwx------ 2 root root 16384 May 10 13:31 lost+found

-rw-r--r-- 1 root root 8 May 10 13:34 persistence.conf

# umount /mnt