1

I have a backup of my encrypted home directory on an external harddrive.

When I use ecryptfs-recover-private /mnt/externalhdd/home/user/.Private/ to mount the encrypted fs of the external hdd it creates a mount point in /tmp/... for it.

But not the ecryptfs of the external HDD is mounted there but my main ecryptfs (!).

Improve this question

2 Answers 2

Reset to default
2

ecryptfs-recover-private error handling is seriously lacking. My version has a bug where it returns success even when you give the wrong mount password. It also gives success when you try to mount just about any directory, regardless of whether it actually contains ecryptfs data or not.

Your problem is you are trying to do the obvious thing and mount home/username/.Private. That won't work! Instead, you need to mount home/.ecryptfs/username/.Private.

Try this:

ecryptfs-recover-private /mnt/externalhdd/home/.ecryptfs/user/.Private/

Follow the prompts and use the login passphrase for your old account, or the mount passphrase if you have it.

Once the mount is complete, you should be able to access the contents of your old account.

Improve this answer
2
  • This is what I do in any case, as it is much faster than having it search.
    – ryanjdillon
    Sep 21, 2016 at 14:08
  • helped me alot in finding the correct mountpoint. Now I am lacking an answer for unmounting. Tip welcome!
    – benni
    Apr 27, 2019 at 11:15
0

It looks like ecryptfs-recover-private works best when ran from a live cd/dvd/usb, and it searches the filesystem for your encrypted home and mounts it in /tmp/... It looks like it's finding your main/regular encrypted home first and not mounting the external backup, or maybe it doesn't find the password for the external backup or something like that... It's supposed to be able to take a target directory and mount that, like you tried, and if you don't specify a directory it's supposed to search for encrypted private directories and "interactively ask you if it's the folder you'd like to recover" (from Dustin Kirkland's blog post about it, he's the author) so try running it without specifying the external directory & see if it finds it? Recommends to run it as root too.

But if it still isn't working then you could try booting from a live cd/dvd/usb, though I suspect it might still find two encrypted folders...

Or if that doesn't work you could follow Dustin's old instructins, from before ecryptfs-recover-private was available, but he's since "crossed out" them, from

http://blog.dustinkirkland.com/2009/03/mounting-your-encrypted-home-from.html

They involve lots of bind mounts & chroot, here's the copypasta from his old directions:

ubuntu@ubuntu$ sudo mount /dev/sda1 /mnt
ubuntu@ubuntu$ sudo mount -o bind /dev /mnt/dev
ubuntu@ubuntu$ sudo mount -o bind /dev/shm /mnt/dev/shm
ubuntu@ubuntu$ sudo mount -o bind /proc /mnt/proc
ubuntu@ubuntu$ sudo mount -o bind /sys /mnt/sys
ubuntu@ubuntu$ sudo chroot /mnt
root@ubuntu$ su - kirkland
kirkland@ubuntu$ ecryptfs-mount-private
Enter your login passphrase:
Warning: Using default salt value (undefined in ~/.ecryptfsrc)
Inserted auth tok with sig [xxx] into the user session keyring
kirkland@ubuntu$ cd $HOME
kirkland@ubuntu$ ls -alF
...
kirkland@ubuntu$ cat .profile
...

The above process assumes that your ~/.ecryptfs/wrapped-passphrase file is available on this system. If you're using 2-factor authentication and storing this elsewhere, you might need to perform an additional mount and symbolic link to make this file available.

Alternatively, if you're trying to recover data, and you've recorded your mount passphrase properly, you would use

kirkland@ubuntu$ ecryptfs-add-passphrase --fnek

just before the ecryptfs-mount-private bit, to manually enter your passphrase (rather than pulling it from ~/.ecryptfs/wrapped-passphrase).

Notes:

  1. /dev/sda1 is the device serving my $HOME/.Private
  2. kirkland is my username, yours will likely be different ;-)
  3. Binding mounting /sys and /proc are critical -- ecryptfs needs access to kernel information shared there
  4. The dash in "su - " is important -- don't forget it!

(End of Kirkland's old instructions)

Then if everything there still doesn't work, you could always try mounting your private directory manually, using mount -t ecryptfs [SRC DIR] [DST DIR] -o [OPTIONS] And see man ecryptfs for info on what the various mount options could be, you might need to know things like the cipher type & key bytes & if no_sig_cache or filename_crypt is enabled, or it might just ask you for the mount passphrase if you just try it with no options? I think the actual mount passphrase might be randomly created & wrapped using your user passphrase, then sored (somewhere in your home? in .Private?), which is why they've got tools like ecryptfs-mount-private & ecryptfs-recover-private.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .