Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I've done something a bit, well, strange. I installed Ubuntu 12.04 directly onto a USB thumb stick, encrypting the /home directory as given the option during the install. The filesystem is btrfs, I believe.

I've now stuck this into my computer running Ubuntu, and I'd like to copy a file onto the USB stick. How can I go about mounting the encrypted home directory so I can copy files to it?

share|improve this question

2 Answers 2

up vote 8 down vote accepted

To get access to the data on your stick and to copy files onto it you need to mount the eCryptfs. This involves several steps:

First you should insert your stick. If Ubuntu doesn't mount it automatically (It usually does.), you should mount it.

Now you should find a directory called .Private. If you did a default installation, this directory should sit in /media/DISK/home/.ecryptfs/USERNAME/.Private. In this example DISK is the directory where your stick is mounted and USERNAME is the name of the user you entered at installation. If you can't find it yourself open a terminal and enter

sudo find /media -type d -name .Private

I assume in the following steps that the directory is in /media/DISK/home/.ecryptfs/USERNAME/.Private.

You need the mount password. This is different from your login pasword. Enter the following command into a terminal:

ecryptfs-unwrap-passphrase /media/DISK/home/.ecryptfs/USERNAME/.Private

You have to enter the login password from the installation of your USB-Ubuntu (not your usual password). The command outputs a passphrase. Write this down or copy it into a file.

The password enables you to unlock the directory. You need to do it in two steps:

> ecryptfs-add-passphrase --fnek
Inserted auth tok with sig [123456789abcdef0] into the user session keyring
> sudo mount -t ecryptfs /media/DISK/home/.ecryptfs/USERNAME/.Private /media/myUSB

The first command adds your passphrase to the kernel keyring and the second tries to mount your .Private to the directory /media/myUSB. If the latte doesn't exist, you have to create it first:

sudo mkdir /media/myUSB

The mount command will ask again for the passphrase. Please enter the output of the above command. Next it will ask for a cipher and key size. You should accept the default values (aes and 16). Type n for plaintext passthrough and y for filename encryption. The last thing is the FileName Encryption Key (FNEK). Look at the output of ecryptfs-add-passphrase --fnek. There are two lines starting with Inserted auth tok …. Insert the value in square brackets of the second output (123456789abcdef0).

Now you can access the files in /media/myUSB and can copy from and to the directory or subdirectories.

A large part of my description is from "Live CD method of opening a encrypted home directory".

share|improve this answer
Thanks. There were three things that caught me that might help others: 1) I needed sudo ecryptfs-add-passphrase --fnek, note the sudo 2) ecryptfs-add-passphrase wants the unwrapped hex phrase but the mount takes the "login" passphrase 3) I needed to redo ecryptfs-add-passphrase after an umount –  bsb Jan 16 '14 at 6:32

The passphrase unwrap did not work. I needed to execute:

ecryptfs-unwrap-passphrase /media/DISK/home/.ecryptfs/USERNAME/.ecryptfs/wrapped-passphrase 
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.