0

My laptop (Ubuntu 12.04) stopped mounting my encrypted home drive today after several months of working fine. I have been using the same login password since I set up the encrypted home drive a few months back with no issues. /var/log/syslog is showing that it is an Incorrect wrapping key for my wrapped passphrase. I figure this means that my wrap-passphrase file is corrupted and is no longer valid. I have my mount passphrase password from when I encrypted the home drive.

I booted from LiveCD and executed the following process:

root@ubuntu:/media/backup/home/me# ecryptfs-recover-private 
INFO: Searching for encrypted private directories (this might take a while)...
INFO: Found [/media/backup/home/.ecryptfs/me/.Private].
Try to recover this directory? [Y/n]: Y
INFO: Found your wrapped-passphrase
Do you know your LOGIN passphrase? [Y/n] n
INFO: To recover this directory, you MUST have your original MOUNT passphrase.
INFO: When you first setup your encrypted private directory, you were told to record
INFO: your MOUNT passphrase.
INFO: It should be 32 characters long, consisting of [0-9] and [a-f].

Enter your MOUNT passphrase: 
INFO: Success!  Private data mounted read-only at [/tmp/ecryptfs.COf2NZVr].

However, when I cd to the tmp folder (i.e. cd /tmp/ecryptfs.COf2NZVr), all I see are encrypted files (ECRYPTFS_FNEK_ENCRYPTED.F...). Based on the question/answer located under ecryptfs-recover-private creating unreadable encrypted folders, it appears they fixed this issue with using the login passphrase. However, as I already pointed out, my login passphrase is not working.

Since the mounted Passphrase is partially working (it allows me to mount up in /tmp the files successfully) is there anything else I can do to get these files unencrypted? Any help would be appreciated.

1
  • Are the files actually decrypted? Can you look at / in some of them and there's regular visible data/text, not just encrypted code? Also check dmesg & /var/log/syslog for any messages about filename encryption / fnek
    – Xen2050
    Dec 6, 2015 at 12:33

1 Answer 1

0

Karl,

I did go back and look at syslog a little more carefully. I was taking it at face value that when ecryptfs-recover-private actually came back and stated it mounted successfully, that it actually did mount and unencrypt. While it is true that it mounted the directory, it was not unencrypted. Once I understood this, I checked my password a realized I was leaving off the last two characters and only putting in 30 instead of the 32. Once I added this, my directory was mounted and the files are unencrypted. Thanks for making me get in there and take a closer look!

I think that the ecryptfs-recover-pivate command should state if it does not unencrypt even if it does mount successfully.

Thanks,

Greg

1
  • The script does check if mount returns success, it uses this line ` if mount -i -t ecryptfs -o "$mount_opts" "$d" "$tmpdir"; then` but apparently it will mount successfully (with the wrong mount passphrase) without working correctly. Using the wrapped-passphrase file would probably fail if you had the wrong login passphrase
    – Xen2050
    Dec 14, 2015 at 4:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .