Kali Linux Live USB Persistence: Overlay, Setup, and Practical Verification

Problem: Repeatable Field Work with a Clean Base

Pen‑testers and incident responders often need a portable system that can be reused across multiple engagements. A fresh Kali image on every boot guarantees no residual artifacts, but it also forces you to reinstall tools, copy wordlists, and re‑configure settings each time. Persistence solves this by overlaying a writable layer on top of the read‑only live filesystem, letting you keep custom files, installed packages, and configuration changes between boots without changing the base image.

Thesis

By creating a dedicated persistence partition and configuring persistence.conf, you can turn an otherwise static Kali live USB into a stateful, repeatable work environment. The overlay is mounted early in boot, so every change you make is stored on the persistence partition, while the original ISO remains untouched.

1. How the Overlay Works

The live boot process performs the following steps:

1. Read‑only root – The ISO image is mounted as a read‑only squashfs (usually at /).
2. Find persistence partition – The kernel looks for a partition labeled persistence on the USB. It can be ext4 or encrypted with LUKS.
3. Mount overlay – If persistence.conf contains a line like / union, the system mounts the persistence partition as a writable layer using overlayfs. The writable layer is merged with the read‑only root, creating a single coherent filesystem.
4. All subsequent writes go to the persistence partition until the next reboot.

OverlayFS is a union filesystem that allows two directories to be presented as one. In this case the lower layer is the ISO image, the upper layer is the persistence partition. When you delete a file from the overlay, the file is *white‑listed* in a special directory called .overlay so the lower layer file is hidden but not removed.

2. Configuring Persistence

Below is a step‑by‑step guide to set up a persistence partition on a USB drive named /dev/sdx (replace sdx with your actual device).

# 1. Identify the device
sudo fdisk -l

# 2. Create a second partition for persistence
sudo fdisk /dev/sdx
#   - Press 'n' for new partition, 'p' for primary, choose the next available number.
#   - Set the first sector to the end of the ISO partition.
#   - Set the last sector to the desired size (e.g., +4G).
#   - Press 'w' to write.

# 3. Format the new partition
sudo mkfs.ext4 -L persistence /dev/sdx2
#   - For encrypted persistence, use:
#     sudo cryptsetup luksFormat /dev/sdx2
#     sudo cryptsetup open /dev/sdx2 persistence
#     sudo mkfs.ext4 -L persistence /dev/mapper/persistence

# 4. Mount and configure persistence.conf
sudo mkdir -p /mnt/persistence
sudo mount -t ext4 /dev/sdx2 /mnt/persistence
#   - Or if encrypted: sudo mount -t ext4 /dev/mapper/persistence /mnt/persistence

echo "/ union" | sudo tee /mnt/persistence/persistence.conf
#   - This tells the bootloader to overlay the root filesystem.

# 5. Clean up
sudo umount /mnt/persistence
if [ -n "$(lsblk -o NAME,TYPE | grep mapper)" ]; then
    sudo cryptsetup close persistence
fi

Run these commands from a live Linux environment (e.g., another Kali or Ubuntu). The / union line is the most common configuration; it mounts the entire root filesystem. If you only need to persist a specific directory, you can use /home union or /var/log union instead.

3. Practical Example: Installing a Package and Storing a File

After setting up persistence, boot the USB using the Live (persistence) menu entry. If you encrypted the partition, you’ll be prompted for a passphrase.

1. Open a terminal and install a lightweight utility:

   sudo apt update
   sudo apt install -y tree
   

2. Create a test file:

   sudo mkdir /root/persistence_test
   sudo touch /root/persistence_test/hello.txt
   

3. Reboot into the persistence mode again.
4. Verify the file and package still exist:

   dpkg -l | grep tree
   cat /root/persistence_test/hello.txt
   

If both the package and the file are present, persistence is working. If not, check that the partition label is exactly persistence, that persistence.conf contains a valid union directive, and that the USB is not write‑protected.

4. Trade‑offs & Limitations

• Capacity is fixed – The persistence partition’s size limits how much data you can store. Exceeding it can cause write failures or corrupt package databases.
• Performance – Writes to a USB stick are slower than an SSD, especially on USB 2.0. Heavy I/O tasks (e.g., large wordlist searches) may feel sluggish.
• Security risk – Unencrypted persistence leaves all captured data, credentials, and SSH keys on the USB in cleartext. Use LUKS if the device may be lost or stolen.
• Complexity of upgrades – Updating the base ISO while keeping the persistence partition intact requires careful planning; a new ISO may need a new partition layout.

5. Verification Checklist

Check	How to Verify
Persistence partition label	lsblk -o NAME,LABEL
persistence.conf syntax	View file: cat /dev/sdx2/persistence.conf
Overlay mount point	After boot, run mount | grep overlay – should show / as overlay.
Writable file	Create a file in /tmp and reboot – it should persist.
Package install	Install a package, reboot, then dpkg -l | grep <pkg>.

Actionable Closing

Persistence turns a Kali live USB into a portable, stateful platform without sacrificing the cleanliness of the base image. By following the partitioning steps above, you can keep your custom tools, wordlists, and configuration changes across sessions. Remember to size the persistence partition appropriately, consider encryption for sensitive data, and routinely check the overlay mount to avoid silent failures. With persistence in place, you can focus on the assessment rather than the setup.