Create a Persistent Kali Linux Live USB with casper-rw

The problem: changes vanish when you reboot

A Kali Linux live USB normally runs from a read-only ISO image. Anything you install, edit, or save disappears when the system shuts down because the live environment discards the writable layer on reboot. The useful takeaway is that a dedicated persistence partition—commonly called casper-rw—can sit on the same USB device and absorb those writes, so they are still there after the next boot.

How the persistence layer works

Assumes a recent Kali Linux live image using syslinux/isolinux. Kali's live-boot scripts look for a writable store on the USB media at startup. When found, they merge it over the read-only live root using an overlay-style mount. Files you create under /root, /home/kali, or system paths are written to the persistence store instead of vanishing. The boot process must also receive a persistence parameter; without it, the scripts ignore the store even if the partition exists.

This guide uses one partition on the USB device labeled casper-rw, formatted as ext4, with a persistence.conf file at its root telling the live system which directories to overlay. Behavior depends on the Kali version and bootloader, so treat the steps as a template and verify each one.

Worked configuration: create the casper-rw partition

Run these commands on a Linux host or from another Kali live session. You need root or sudo access. Replace /dev/sdX with your actual USB device; choosing the wrong device erases data.

1. Identify the USB device. Run lsblk and note the device name, for example /dev/sdb. Confirm the size matches your USB stick before proceeding.
2. Unmount any mounted partitions.
   

   sudo umount /dev/sdX1 2>/dev/null || true

   Run as root. The || true prevents the command from failing if nothing is mounted.
3. Create one partition and format it.
   

   sudo mkfs.ext4 -L casper-rw /dev/sdX1

   This formats the first partition as ext4 and sets the volume label to casper-rw. Risk: this destroys everything on /dev/sdX1.
4. Mount the partition and add the persistence configuration.
   

   sudo mount /dev/sdX1 /mnt
   echo "/ union" | sudo tee /mnt/persistence.conf
   sudo umount /mnt

   The persistence.conf entry / union tells the overlay to merge the persistence store with the live root filesystem.
5. Enable persistence at boot. Edit the bootloader configuration on the USB, commonly /syslinux/syslinux.cfg on the live partition, and add persistence to the kernel command line for the entry you use. Alternatively, press Tab or e in the boot menu and append persistence temporarily for one boot.

Placeholders: /dev/sdX is the target USB device, /dev/sdX1 is its first partition, and /mnt is a temporary mount point. Do not use /dev/sda unless you have confirmed it is the removable USB and not your host system disk.

Verify persistence before you rely on it

Boot the USB with the persistence parameter. After the desktop loads, run:

mount | grep casper-rw

Expected result: a line showing the casper-rw device mounted with rw options, often over a path such as / or a live overlay mount. If nothing appears, persistence is not active.

Next, create a marker file and reboot:

touch /root/persistence-verify.txt
reboot

After the system comes back, check:

ls -l /root/persistence-verify.txt

If the file exists, writes survived the reboot. If it is missing, the partition label, boot parameter, or persistence.conf is misconfigured.

You can also confirm the boot parameter reached the kernel:

cat /proc/cmdline | grep persistence

Limits and common mistakes

• No encryption by default. The casper-rw partition is readable by anyone with physical access to the USB. Do not store secrets there without adding separate encryption.
• Filesystem choice matters. A casper-rw file on FAT32 cannot exceed 4 GB. Use an ext2/3/4 partition for larger stores.
• Unclean removal risks corruption. Unmount the store or shut down cleanly before unplugging the USB. Sudden power loss can corrupt the ext4 journal.
• Wrong device in mkfs. This is the most destructive mistake. Verify lsblk output twice.
• Missing boot parameter. A correctly formatted partition does nothing if persistence is absent from the kernel command line.
• Not a full system clone. Persistence overlays changes; it does not preserve a customized kernel or bootloader configuration across re-imaging the USB.

Rollback

Creating the partition changes the USB state. To return to a standard non-persistent live USB, delete or reformat the casper-rw partition and remove the persistence boot parameter:

sudo wipefs -a /dev/sdX1

Then repartition the USB as needed. This erases all persistent data on that partition.

Practical check

The reliable check is the reboot test: create a file in /root or /home/kali, reboot, and confirm it remains. Combine that with mount | grep casper-rw and cat /proc/cmdline to distinguish "persistence not enabled" from "persistence enabled but not mounting."