How to recover my encrypted files?

Question

Story:

I lost Ubuntu GUI (unknown problem).
Then tried to recover files via Windows, so I could reinstall Ubuntu. But, when mounting /home partition to Windows, a malware copied the files into a folder named " " (space) and created a shortcut.
When I tried to recover my encrypted files through an Ubuntu live CD using ecryptfs-recover-private, I got this:

You may not see the (space) folder, but it's accessible through LiveUSB's GUI.

Then I managed to rename the (space) folder, but I think I accidentally deleted files: README.txt and Access-Your-Private-Data.desktop

Please don't post pictures of text. Copy-paste the text instead. — wjandrea, Feb 23, 2017 at 18:14
Based on the terminal output, there is no folder called " ". What were you trying to do there? — wjandrea, Feb 23, 2017 at 18:17
2. the malware has copied only the files that appeared in the encrypted /home directory into a folder named with one space. now i managed to rename that folder, so it's a no worry. — nad.js, Feb 23, 2017 at 18:53
@wjandrea now i just logged in to my ubuntu system in terminal mode (as i said i have GUI issue) and i run Access-Your-Private-Data.desktop file, so i was prompted for passphrase. i entered it, but i got error saying: Error: Unwrapping passphrase failed [-2]; Info: Check the system log for more information from libecryptfs — nad.js, Feb 23, 2017 at 19:23
Oh, you got ransomware! That sucks. Windows malware is a whole other can of worms, so I'm not sure AskUbuntu is the best place to ask for advice. Maybe SuperUser.com would be better. — wjandrea, Feb 23, 2017 at 19:32

Noneeee · Accepted Answer · 2017-08-04 09:01:33Z

I had problems with file recovery - I would like to share how I managed to do it:

sudo find /media -type d -name .Private

sudo ecryptfs-recover-private

(example: sudo ecryptfs-recover-private /media/ubuntu/1efe72f6-86-41e9-9d46 c7b2bb9a1b61/username/.Private)

I used not an encrypted pass phrase, but password of Ubuntu login and it worked (strangely encryption pass phrase didn't work for me – try both).

After successful attempt directory will be created in /tmp/created folder name by system.
to access those files I had to be root:

sudo se

nautilus /tmp/created folder name by system

to copy desired folders, files had to select them, mouse right click "Copy To..."

Hope it will help someone that are not so skilled with Ubuntu like me :)

1 Answer 1