1

I have a big problem! i accentually deleted a very imported folder in my home dir while creating a backup. I stopped the backup, shutdown the laptop, but there are still a lot of files to be backed up. So I am afraid of manipulating the encrypted home.

The home is encrypted via ecryptfs and the system Ubuntu 13.04.

I tried to use extundelete from a live usb stick. For the recovery the partition has to be unmounted but then home is encrypted and a recovery of the Document folder is not possible.

Can anybody give my an advise to to recover a folder inside the encrypted home?

The data is very imported because containing a dairy.

Improve this question
1
  • You should stop working on that volume immediately. Unmount or mount -o ro it. Do the recovery from a live system if necessary.
    – David Foerster
    Oct 22, 2014 at 18:02

2 Answers 2

Reset to default
2

You're right in your assumption that you need to unmount the ecryptfs-encrypted file system. ecryptfs works on top of an underlying file system whereas undeletion tools like extundelete operate on ext file systems like the one you probably have underneath your ecryptfs file system.

You don't need access to the unencrypted document files to undelete them. Instead you'll undelete the encrypted files in ~/.Private or wherever your ecryptfs file system is located (not mounted).

For the actual undeletion procedure refer to other answers like:

Improve this answer
2
  • Recovery is often difficult at best and encryption will make it more difficult.
    – Panther
    Oct 22, 2014 at 13:17
  • It is a comment, not an answer. I do not think your suggestion is going to easily work due to encryption.
    – Panther
    Oct 22, 2014 at 17:50
2

I was able to recover a deleted file from my ecryptfs encrypted home folder using photorec. This resulted in a large number of files that looked like f20747184.eCryptfs in recup_dir.* directories.

I moved them all to their own directory.

mkdir -p crypted

mv recup_dir.*/*.eCryptfs crypted

I recovered my mount password.

sudo ecryptfs-unwrap-passphrase

I mounted the crypted directory.

sudo ecryptfs-recover-private crypted/

This successfully mounted into a /tmp/ecryptfs.*/ directory. The filenames are not helpful so I grepped for a keyword that I knew was in the file.

grep -R "technology" /tmp/ecryptfs.*

I found the file and moved it back.

I know this is an old thread, but this was the first page I found when searching for the solution.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .