Recovering an encrypted home folder in Ubuntu

Question

I was trying to upgrade to 18.04, and after reboot, I could not log in, even on a virtual terminal (Alt+Ctrl+F1). I don't know the exact reason, but my assumption is there was less space in home that makes it unresponsive.

I tried various ways to recover: fixing the packages, logging in to a root shell, etc. I tried via Live USB, but that shows ecryptfs-* command not found, and I was not able to install the encypt-utils.

As the /home was on a different partition (sda5), I thought there will not be any trouble and re-installed a fresh Ubuntu from Live USB on sda1. This time /home of the new user is kept on sda1 itself.

After installation, I was checking the sda5 files and noticed some symbolic links which were pointing to /usr/share/ecryptfs-utils/ecryptfs-mount-private.desktop.

hari@hari-Vostro-270s:/media/hari/sda5/hari$ ls -la
total 12
dr-x------ 3 hari hari 4096 Mar  6  2016 .
drwxr-xr-x 6 root root 4096 Apr 24 14:04 ..
lrwxrwxrwx 1 hari hari   56 Mar  6  2016 Access-Your-Private-Data.desktop -> /usr/share/ecryptfs-utils/ecryptfs-mount-private.desktop
drwx------ 3 hari hari 4096 Jul 14 00:57 .cache
lrwxrwxrwx 1 hari hari   30 Mar  6  2016 .ecryptfs -> /home/.ecryptfs/hari/.ecryptfs
lrwxrwxrwx 1 hari hari   29 Mar  6  2016 .Private -> /home/.ecryptfs/hari/.Private

So the question is, is there any way I can recover this files?

Currently, these are what I tried: https://help.ubuntu.com/community/EncryptedPrivateDirectory#Recovering_Your_Data_Manually

/media/hari/sda5  sudo ecryptfs-add-passphrase --fnek
Passphrase: 
Inserted auth tok with sig [x1] into the user session keyring
Inserted auth tok with sig [x2] into the user session keyring
/media/hari/fs1  ls
hari  lost+found
/media/hari/sda5  sudo mount -t ecryptfs hari/.Private /media/hari/sda6/Private
Passphrase: 
Select cipher: 
1) aes: blocksize = 16; min keysize = 16; max keysize = 32
2) blowfish: blocksize = 8; min keysize = 16; max keysize = 56
3) des3_ede: blocksize = 8; min keysize = 24; max keysize = 24
4) twofish: blocksize = 16; min keysize = 16; max keysize = 32
5) cast6: blocksize = 16; min keysize = 16; max keysize = 32
6) cast5: blocksize = 8; min keysize = 5; max keysize = 16
Selection [aes]: 
Select key bytes: 
1) 16
2) 32
3) 24
Selection [16]: 
Enable plaintext passthrough (y/n) [n]: 
Enable filename encryption (y/n) [n]: y
Filename Encryption Key (FNEK) Signature [x3]: x2
Attempting to mount with the following options:
ecryptfs_unlink_sigs
ecryptfs_fnek_sig=x2
ecryptfs_key_bytes=16
ecryptfs_cipher=aes
ecryptfs_sig=x3
Mounted eCryptfs

When looking at the folder, I see:

Error when getting information for file “/media/hari/sda6/home/hari/Downloads/ECRYPTFS_FNEK_ENCRYPTED.FaZDpGgT5TPsrkSs1DMefcCqBFbkbc4LjbP7JXvWgIwh8viAPRHdxH9uEQA3BCl6zOy0opxnxxwj9moqSlFooMTLPDqqLrAlt.e-LrMJZLdyssF7ZGlYJMA5cME2-uUuon-Fy.sd-”: File name too long.

From the CLI, when I did ls -la it looks something like

ls: cannot access 'ECRYPTFS_FNEK_ENCRYPTED.FWZDpGgT5TPsrkSs1DMefcCqBFbkbc4LjbP7HL3q.4olYwLoHZi74seXAE--': No such file or directory
ls: cannot access 'ECRYPTFS_FNEK_ENCRYPTED.FWZDpGgT5TPsrkSs1DMefcCqBFbkbc4LjbP77AGTg1son88qIRwdejeFu---': No such file or directory
ls: cannot access 'ECRYPTFS_FNEK_ENCRYPTED.FXZDpGgT5TPsrkSs1DMefcCqBFbkbc4LjbP7XXb-PophSPyw.c0ewSMEx0pqOWrvDb2XoytnRZLky---': No such file or directory
ls: cannot access 'ECRYPTFS_FNEK_ENCRYPTED.FWZDpGgT5TPsrkSs1DMefcCqBFbkbc4LjbP7HACG14lCkG2p3vKLYqZDhk--': No such file or directory

Is there any way I can get this solved?

Answer 1

This is very likely fairly easy to fix early on, not requiring recovering anything. Unfortunately, there's the possibility that attempting to recover them has damaged them, but that's not a certainty.

The original problem is almost definitely that you didn't mark /home as the mount point of /dev/sda5 when installing, so it assumed you wanted to create /home anew in the / partition. This can be corrected in the following manner:

1. Back up any newly-created files you want to keep from the new /home folder to a USB drive or a cloud file backup service or something like that, because the new /home folder will be inaccessible.
2. Reboot in recovery mode.

3. Verify that the partition /dev/sda5 exists:

   ls -alF /dev/sda5
   

4. Assuming it exists, temporarily mount /dev/sda5 to /mnt:

   mount /dev/sda5 /mnt
   

5. Check that /mnt has a directory with your username (your old home directory):

   ls -alF /mnt
   

6. Back up the automount configuration file:

   cp /etc/fstab /etc/fstab.bak
   

7. Assuming that you see your home directory, automount the old /home (/dev/sda5) on future boots (note: it's >>, not >; make sure there are two greater-than signs):

   echo "UUID=$( findmnt -no UUID /mnt ) /home $( findmnt -no FSTYPE /mnt ) errors=remount-ro 0 2" >> /etc/fstab
   

8. Check /etc/fstab to ensure that there are several lines in it and that there's a new /home line at the very bottom (if not, you can cp /etc/fstab.bak /etc/fstab to recover /etc/fstab, correct the last command, and try again):

   cat /etc/fstab
   

9. Assuming that /etc/fstab looks good and that you've backed up everything you needed from the new /home directory, unmount /mnt:

   umount /mnt
   

10. Delete the new /home directory because it'll never be accessible again and you might as well have the extra disk space:

    rm -rf /home
    

11. Recreate an empty /home directory as a mount point:

    mkdir /home
    

12. Mount everything again, including the old /home directory:

    mount -a
    

13. Check that /home has a directory for your username:

    ls -alF /home
    

14. If your home directory is there, reboot:

    reboot
    

Now your old /home directory should be available after the reboot finishes. If you encounter further issues, please let us know.

Answer 2

Could you connect via ssh or tty and exec:

$ ecryptfs-mount-private 

it possible helps you'll see crypted files in your Private folder

The second variant - to restore your files:

sudo ecryptfs-recover-private /$HOME/.Private 

(by default they save in /tmp/ecryptfs.ХХХХХХХ)