Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I had an encrypted home dir in my Ubuntu partition (system and home together). I left the live usb plugged in and someone reinstalled Ubuntu over that partition.

I read all I could on the net about people with similar issues. First of all, I stopped using the affected hard drive (writing this from a Lubuntu live cd). Then I ran Photorec on the affected disk, without any filter (i.e. recover everything). The results are now sitting in an external disk.

Among all the files, I think it's the .eCryptfs ones I need. However, I only know my login password. I never wrote down the mount passphrase. I know I can recover it with just my login password if I find the wrapped-passphrase file.

However, Photorec didn't recover the original name of any file (I believe it names them according to the disk sector from which they were recovered). Moreover, all files are distributed among different directories (recup_dir.1 and so on).

Is my only choice to wade through the millions of txt files until I find wrapped-passphrase? I don't think I could recognize it, since most surely it's a byte stream and there might be millions of files like that...

EDIT: Just in case anyone was wondering, the version was 12.04 (which means the filenames were encrypted, IIRC)

EDIT2: I created an Ubuntu 12.04 virtual machine with the same user and password as my old system and enabled home dir encryption. Here's the resulting wrapped-passphrase file:

enter image description here

share|improve this question
1  
If I remember correctly r-linux is capable of file recovery with its actual name. So use it to recover wrapped-passphrase –  totti Jun 19 at 9:08
    
Can you upload/show a sample wrapped-passphrase file –  totti Jun 19 at 9:13
    
@totti, I will try r-linux as soon as I can and get back to you. Also, I edited my question adding a wrapped-passphrase sample. –  dario_ramos Jun 19 at 15:37
    
what about r-linux. Try grep -inR --binary-files=text f2bbda0 from the root folder of recovered data. –  totti Jun 23 at 15:47
    
Sorry I disappeared on you guys, I came down with a bad flu. I tried grepping the rescued files, didn't find anything. It seems like all the recovered files have some extension; there are no plain binary files without extension like wrapped-passphrase. Then I downloaded r-linux and scanned my partition. It recognized only the current partition (overwritten) and a bunch of extra found files. If I browse them, they look just like the ones Testdisk recovered. And I can only browse them by type/extension. I looked for wrapped-passphrase using the Find Files tool but nothing was found. Ideas? –  dario_ramos Jul 4 at 3:17

1 Answer 1

Since you possibly have the content of the missing wrapped-passphrase file, why don't you run a recursive grep on the files you rescued? I would suggest to start only with the first 16 characters, f...2.

GL!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.