In this tutorial, we will learn how to create, attach, and mount an EBS volume to an Ubuntu EC2 instance. We will then create and delete some files, detach this, and then try to extract the deleted data:

1. Go to EC2 | Volumes and create a new volume. For this exercise, we are creating an additional volume size of 8 GB:

If you want your volume to be encrypted (this is optional), perform the following steps:

• 1. Select the checkbox for Encrypt this volume
  2. Select the Key Management Service (KMS) Customer Master Key (CMK) to be used under Master Key
  3. Select Create Volume

2. Select the created volume, right-click, and then select the Attach Volume option.
3. Select the Ubuntu instance from the Instance textbox:

4. Secure shell (SSH) into your Ubuntu instance and list the available disks using the following command:

lsblk

This will list the disk you attached to your instance. In this case, we can see a device named /dev/xvdf.

5. Check if the volume has any data using the following command:

sudo file -s /dev/xvdf

If the preceding command output shows /dev/xvdf: data, it means that your volume is empty.

6. Now we will have to format the volume to the ext4 filesystem. To do this, issue the following command:

sudo mkfs -t ext4 /dev/xvdf

7. Next, we will create a directory to mount our new ext4 volume. Here, we are using the name, newvolume:

sudo mkdir /newvolume

8. Finally, we mount the volume to the newvolume directory using the following command:

sudo mount /dev/xvdf /newvolume/

9. You may go into the newvolume directory and check the disk space for confirming the volume mount:

cd /newvolume
df -h .

10. Once the volume is attached, we can write data to it. We will create a data.txt file and write some data to it. This file will then be deleted, and we will later try to recover the file using TSK:

sudo touch data.txt
sudo chmod 666 data.txt
echo "Hello World" > data.txt

11. Let's now delete the file, which we will recover later:

sudo rm -rf data.txt

12. It's time to detach the volume. We will start by unmounting the volume first; move back out of the folder and issue this command:

sudo umount -d /dev/xvdf

Now, let's detach the volume from the EC2 instance:

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
2. In the navigation pane, choose Volumes.
3. Select a volume and choose Actions | Detach Volume:

4. In the confirmation dialog box, choose Yes.

Thus, we have successfully detached the volume from our EC2 instance.