Tails can try to fix these errors, but this might erase some of your data and take a long time.

That is why, if you cannot restore from a recent backup, we recommend that you create a partition image of your Persistent Storage before attempting to repair the file system of your Persistent Storage from the Welcome Screen.

Most of the time, repairing the file system will work fine and will be enough to fix your Persistent Storage.

In the rare cases when repairing the file system will not work, you might be able to recover some or most of your data from this partition image using advanced forensics tools. This recovery process is very technical and you might need help from someone experienced with data recovery.

Creating a partition image of your Persistent Storage

A partition image is a copy of your entire Persistent Storage in a single file that you can save to an external hard disk from Tails.

To save the partition image outside of Tails, you need an external hard disk with as much free space as the size of your Persistent Storage, usually 8 GB less than your Tails USB stick. You can also use another USB stick of the same size as your Tails USB stick, but writing to a USB stick is usually much slower than writing to a hard disk.

We are presenting here 2 different techniques to create a partition image of your Persistent Storage.

1. Create a partition image using the Disks utility

   Try this technique first if the hardware of your USB stick is not failing.

2. Create a partition image using ddrescue on the command line

   Try this technique first if the hardware of your USB stick is failing.

   Using ddrescue is more difficult but is better than the Disks utility to recover data if the hardware of your USB stick is failing.

Creating a partition image using the Disks utility

When the hardware of your USB stick is not failing, using the Disks utility is the simplest way of creating a partition image of your Persistent Storage.

Preparing the external hard disk

1. Start Tails.

2. In the Welcome Screen:

   1. Set up an administration password.

   2. Choose to start without unlocking your Persistent Storage.

3. Choose Applications ▸ Files to open the Files utility.

4. Plug in the hard disk on which you want to save the partition image of your Persistent Storage. You need as much free space as the size of your Persistent Storage, usually 8 GB less than your Tails USB stick.

   A new disk appears in the sidebar of the Files utility.

5. Right-click (on Mac, click with two fingers) on the new volume that appeared in the sidebar of the Files utility and choose Properties in the shortcut menu.

   Take note of the free space in the disk.

Identifying your Persistent Storage in the Disks utility

1. Choose Applications ▸ Utilities ▸ Disks to open the Disks utility.

2. In the left pane of the Disks utility, identify your Tails USB stick in the list of storage devices.

   Verify its brand and size.

3. In the left pane, click on the storage device that corresponds to your Tails USB stick.

4. In the right pane, this storage device should have 2 volumes, corresponding to 2 partitions on the USB stick.

   • 1 volume with a TAILS label and FAT content.

     This volume corresponds to the system partition of your Tails.

   • 1 volume with a TailsData label and LUKS content.

     This volume corresponds to the encrypted version of your Persistent Storage.

   

5. In the right pane, click on the volume that corresponds to your Persistent Storage.

   Verify that the content of the volume is of type LUKS Encryption.

Unlocking your Persistent Storage in the Disks utility

Before creating the partition image, unlock the encryption to access the decrypted version of your Persistent Storage. To do so:

1. Click .

2. In the Enter passphrase to unlock dialog, enter the passphrase of your Persistent Storage.

3. Click Unlock.

4. In the Authentication Required dialog, enter your administration password.

   If unlocking fails at this step, your Persistent Storage is so damaged that decryption is impossible, making all your data completely unrecoverable.

5. In the right pane, click on the new volume that appears below the LUKS volume.

   Verify that the content of the new volume is of type Ext4.

   This volume corresponds to the decrypted version of your Persistent Storage.

6. Verify that the size of your decrypted Persistent Storage is smaller than the available free space in the external hard disk.

7. Take note of the device name of your Persistent Storage.

   The device name is composed of /dev/mapper/luks, followed by letters and numbers.

Creating the partition image

1. Choose  ▸ Create Partition Image.

2. In the Create Disk Image dialog:

   • In the Name field, specify persistent-storage.img.

   • In the Save in Folder menu, choose the external disk to which you want to save the partition image.

   Click the Start Creating button.

3. In the Authentication Required dialog, enter your administration password.

4. After the creation of the partition image finishes:

   • If the creation succeeded, shutdown Tails.

     You can now safely start recovering data from the Persistent Storage.

   • If the creation failed, try the second technique described below to create a partition image using ddrescue on the command line instead.

Creating a partition image using ddrescue on the command line

If creating a partition image using the Disks utility fails, you can try this second technique using ddrescue, which can be more resilient to hardware failures.

The ddrescue utility tries to copy first the parts of the Persistent Storage that are not failing and skips over the parts that are failing. After that, you can run ddrescue again to try to copy the parts that failed the first time.

1. Choose Applications ▸ Files to open the Files utility.

2. In the Files utility, navigate to the folder of the external hard where you want to save the partition image of your Persistent Storage.

3. Right-click in the empty space of the right pane and choose Open in Terminal in the shortcut menu.

   Doing so opens a terminal that is configured to operate in this folder.

4. In the terminal, execute the following command. Replace /dev/mapper/luks-xyz with the device name found when identifying your Persistent Storage in the Disks utility.

   ddrescue /dev/mapper/luks-xyz persistent-storage.img ddrescue.log

   The output of ddrescue looks like this:

   GNU ddrescue 1.27
   Press Ctrl-C to interrupt
        ipos:  749404 kB, non-trimmed:        0 B,  current rate:  34996 kB/s
        ipos:    1446 MB, non-trimmed:        0 B,  current rate:  24772 kB/s
        opos:    1446 MB, non-scraped:        0 B,  average rate:  33629 kB/s
   non-tried:    9290 MB,  bad-sector:        0 B,    error rate:       0 B/s
     rescued:    1446 MB,   bad areas:        0,        run time:         43s
   pct rescued:   13.46%, read errors:        0,  remaining time:      1m 31s
                                 time since last successful read:          0s
   Copying non-tried blocks... Pass 1 (forwards)
   

   The section about bad areas refers to errors reading the data of your Persistent Storage, most likely because of hardware failures.

5. After ddrescue finishes:

   • If bad areas were reported, try leaving your USB stick to rest for some minutes and executing the same ddrescue command again to copy more data.

     We recommend that you replace your USB stick and copy the partition image to a new USB stick after you execute ddrescue several times.

   • If no bad areas were reported or if the same bad areas were reported after several executions of the ddrescue command, it means that all the data that could be rescued was copied to the partition image.

6. Shut down Tails.

   You can now safely start recovering data from the Persistent Storage.

Recovering data from the Persistent Storage

After creating a partition image, you can safely try to recover data from your Persistent Storage without risking erasing more data.

We are presenting here 3 recovery techniques that work in different cases. We recommend that you try the 3 techniques one after the other.

1. Repairing the file system from the Welcome Screen

   If the hardware of your USB stick is not failing, repairing the file system from the Welcome Screen is likely the easiest technique.

2. Copying the partition image to a new USB stick

   If the hardware of your USB stick is failing, you might still be able to repair the file system of your Persistent Storage after copying the partition image to a new USB stick.

3. Analyzing the partition image using Autopsy

   Autopsy is an advanced digital forensics tool that allows recovering files, even from broken file systems.

Repairing the file system from the Welcome Screen

If the hardware of your USB stick is not failing, repairing the file system from the Welcome Screen is likely the easiest technique.

1. Start on the Tails USB stick that has file system errors.

2. In the Welcome Screen, try to unlock the Persistent Storage.

3. When the error message about file system errors appears, click on the Repair File System button.

   

4. The repair of the file system starts.

   The repair can take a long time, from a few seconds to several hours.

   If the repair takes more than a day, shutdown Tails and try analyzing the partition image using Autopsy instead.

   

5. After the repair finishes:

   • If the repair succeeded, start Tails and verify the content of your Persistent Storage.

     We recommend that you keep the partition image for some time.

     If you realize later on that some files are missing or damaged, you might be able to recover them by analyzing the partition image using Autopsy.

   • If the repair failed, try to copy the partition image to a new USB stick as described below.

Copying the partition image to a new USB stick

If the hardware of your USB stick is failing, you might still be able to repair the file system of your Persistent Storage after copying the partition image to a new USB stick.

Creating a new Tails USB stick with Persistent Storage

1. Install Tails on a new USB stick.

   The new USB stick must be at least as large as your current Tails USB stick.

2. Start on the new Tails.

3. When starting Tails, set up an administration password.

4. Create a Persistent Storage on the new Tails.

5. Close the Persistent Storage settings after creation, when the list of features is displayed.

   The process described below overwrites the contents and configuration of the new Persistent Storage. So, it does not matter which features you turn on after creating the Persistent Storage.

Copying the partition image onto the new USB stick

1. Choose Applications ▸ Utilities ▸ Disks to open the Disks utility.

2. In the left pane of the Disks utility, identify your new Tails USB stick in the list of storage devices.

   Verify its brand and size.

3. In the left pane, click on the storage device that corresponds to your new Tails USB stick.

4. In the right pane, this storage device should have 3 volumes.

   • 1 volume with a TAILS label and FAT content.

     This volume corresponds to the system partition of your Tails.

   • 1 volume with a TailsData label and LUKS content.

     This volume corresponds to the encrypted version of your Persistent Storage.

   • 1 volume with a TailsData label and Ext4 content.

     This volume corresponds to the decrypted version of your Persistent Storage.

5. In the right pane, click on the Ext4 volume, which is the one that corresponds to the decrypted version of your Persistent Storage.

   In the attributes listed below the volume, verify that the content of the volume is mounted at /home/amnesia/Persistent.

6. Click on the button to unmount the Persistent Storage.

7. Plug in the hard disk on which you saved the partition image of your Persistent Storage.

8. Choose  ▸ Restore Partition Image.

9. In the Restore Disk Image dialog, browse for the partition image on the hard disk that you plugged in.

10. Click on the Start Restoring button.

11. After the restoration finishes, restart on the new Tails USB stick.

Fixing the file system errors on the new USB stick

1. In the Welcome Screen, try to unlock the Persistent Storage.

2. If an error message about file system errors appears, click on the Repair File System button.

   

3. The repair of the file system starts.

   The repair can take a long time, from a few seconds to several hours.

   If the repair takes more than a day, shutdown Tails and try analyzing the partition image using Autopsy instead.

   

4. After the repair finishes:

   • If the repair succeeded, start Tails and verify the content of your Persistent Storage.

     We recommend that you keep the partition image for some time.

     If you realize later on that some files are missing or damaged, you might be able to recover them by analyzing the partition image using Autopsy.

   • If the repair failed, try to analyze the partition image using Autopsy as described below.

Analyzing the partition image using Autopsy

Autopsy is an advanced digital forensics tool that allows recovering files, even from broken file systems.

Autopsy is open source and available for free on Windows, macOS, and Linux.

To avoid leaving traces of the content of your Persistent Storage on the operating system where Autopsy is used, we recommend that you use Autopsy in Tails. But, Autopsy is easier to install in Windows than in Tails.

We are not providing step-by-step instructions on how to install and use Autopsy.

If you don't feel confident installing and using Autopsy on your own, we recommend that you get help from someone with more experience with Linux and data recovery.

You can also read the Autopsy User Documentation.

Installing Autopsy in Tails

The general steps are:

1. From the download page, download the 2 binaries needed to run Autopsy:

   • The DEB file of The Sleuth Kit.

   • The ZIP file of Autopsy.

2. From the installation instructions of Autopsy for Linux, download the 2 scripts needed for the installation:

   • install_prereqs_ubuntu.sh

   • install_application.sh

3. Execute the following commands in a Terminal. You might have to adjust to newer versions of Autopsy.

   bash install_prereqs_ubuntu.sh

   sudo apt install libsqlite3-dev libc3p0-java unzip

   sudo dpkg -i sleuthkit-java_4.12.1-1_amd64.deb

   bash install_application.sh -z autopsy-4.21.0.zip -i ~/Persistent/autopsy -j /usr/lib/jvm/java-17-openjdk-amd64

   /home/amnesia/Persistent/autopsy/autopsy-4.21.0/bin/autopsy

4. When starting for the first time, Autopsy freezes on Starting modules.

   Press Enter to continue.

Using Autopsy to analyze the partition image

The general steps are:

1. Start Autopsy.

2. Open a new case.

3. Add the partition image of the Persistent Storage as a data source.

4. Autopsy analyzes the data source.

   After the analysis finishes, the files that were recovered are listed in different ways in the left sidebar, for example, both as a file system tree and by type of files.

   

5. Extract the files that you want to recover to the case folder.