How to add persistence to entire Kali filesystem?

Question

So I've set up a live USB with Kali for pentesting, and I'm now trying to get persistence working on it. So far, the USB has been partitioned and an ext2 filesystem installed.

When I open Kali, there is an unusual folder on the desktop with the icon of a hard drive disk whose name is MyPersistence, the name I chose for the persistence partition. The path of this folder is /media/root/MyPersistence. Anything I save in this directory gets persisted correctly.

However, nothing outside the directory gets persisted at all.

At the Kali boot menu, when presented with options, I hit tab and it brings up a small console pre-filled with this command:

.linux /live/vmlinuz noprompt cdrom-detect/try-usb=true boot=live username=root hostname=kali initrd=/live/initrd.img

According to instructions I've followed, I'm supposed to add persistence as a parameter to this at the end, and run it. But this produces no apparent change, nothing is different. What is that parameter? Is it supposed to be the name of the partition, MyPersistence in my case? What is .linux and where can I find more information about the parameters it takes?

Additionally, there was this in the instructions:

mkdir -p /mnt/my_usb
mount /dev/sdc2 /mnt/my_usb
echo "/ union" > /mnt/my_usb/persistence.conf
umount /dev/sdc2 && reboot

But it also has no effect.

Answer 1

The goal of persistance is to allow you to keep the content of one folder (for instance /home) across reboots. You cannot have persistance on the whole system because it is stored in an ISO file that gets loaded when you boot.

What you are looking for is to do a full install of Kali on USB stick. In that way, you'll be able to access the whole file system, like if it was installed on your computer. To do that, follow this tutorial to install kali : http://docs.kali.org/installation/kali-linux-hard-disk-install and when choosing for a disk at step 10, select your USB drive. Make sure not to select your hard drive cause it would wipe it out. For more security, consider unplugging your hard drive before doing that.

Answer 2

Actually I've noticed two folders appear on the persistent partition, 'rw' and 'work'. It seems that a properly placed persistence.conf file (with the contents '/ union' causes this. The commands you mentioned do this from the command line, but it doesn't matter how you get it there. All the updates and downloads you add and perform after this, while booted into live USB w/ persistence from grub, will appear in the rw folder. I suspect the work folder to be a place holder for an additional encrypted partition, but have found precious little documentation on setting this up and creating the proper entry in grub to boot into it, or how it is supposed to 'work'... I don't usually require that level of security. For basic USB persistence while live booting, the key is placing that text file in the root of the 3rd partition. The rest should be automatically handled by the os