Diskprobe Deb
Once you have a disk inspection tool installed (whether it’s called DiskProbe, wxHexEditor, or a custom tool), the methodology remains the same. Let's assume you have a utility that can open raw devices.
| What you type | What exists in Debian repos |
|---------------|-----------------------------|
| sudo apt install diskprobe | Error: Unable to locate package |
| apt search diskprobe | No results |
Why? The diskprobe binary is not distributed as a separate .deb. Instead, it is bundled inside the sleuthkit package. diskprobe deb
After installing the .deb, you cannot simply click an icon and edit /dev/sda. Linux requires elevated privileges for raw disk access.
Solution: Install Qt5 runtime libraries: Once you have a disk inspection tool installed
sudo apt install qt5-default libqt5core5a libqt5gui5
You can manually edit bytes (dangerous) or export sectors for further analysis.
dh_make -p diskprobe_1.4.1 --createorig
If you want similar low-level disk editors/inspectors available as standalone .deb packages:
But none offer the filesystem-structure interpretation of diskprobe. You can manually edit bytes (dangerous) or export
sudo apt update
sudo apt install diskprobe
Verify:
diskprobe -V
Note: In some distros, diskprobe is part of sleuthkit (which also includes mmstat, icat, etc.). If diskprobe isn’t found, install sleuthkit.