I found two SSDs infected with ransomware and want to inspect them with Linux before reusing them in a Windows PC. I'm booting Trixie from a live USB and don't want to mount the drives in Windows. The disks appear as /dev/sdd with two partitions, /dev/sdd1 and /dev/sdd2. I initially couldn't install GParted because the package manager reported "Unable to locate package gparted." Is there another way to erase both SSDs completely, and can I first copy the encrypted pictures somewhere for possible recovery later?
3 Answers
Trixie’s live environment may include GNOME Disks, which can mount the partitions and let you copy files to another drive before erasing anything. You can also look for it in the application menu or launch it from a terminal with `gnome-disks`. Be careful to verify the correct device before formatting.
The package error may simply mean the live session was offline or its package lists were unavailable. After enabling the internet connection, refresh the package lists and install GParted normally. Once your files are backed up, GParted can remove both partitions and create a fresh partition table for the SSDs.
That was the issue in my case. After I enabled the network connection, GParted installed successfully and I used it to wipe and repartition the drives.
If you want a graphical tool specifically for disk operations, you can boot a dedicated utility such as GParted Live, Rescuezilla, or SystemRescue. These provide ways to delete partitions and create a new partition table, though you should copy anything worth keeping before doing that. If the ransomware encrypted the files, changing extensions back will not restore them; the contents remain encrypted.
I’ll check whether GNOME Disks is installed and try launching it from the terminal so I can preserve the files first.