1

I have installed Ubuntu 18.04.1 with Full-Disk Encryption with two passwords, one for disk login and another for Home Directory login.

If I drag a file to the Trash, then I "Empty Trash," can someone recover that file? Basically, does the un-encryption process un-encrypt the emptied trash?

I'm thinking in terms of a repair person who might need disk access.

  • 1
    If you're depending on this, you better check my answer, because from your description you did not just encrypt your home directory (ecryptfs), but your whole disk (LUKS). In that case, the answer is the opposite of @waltinator's. And I would indeed attend to this, as our spies have been known to work with such establishments as the "Geek Squad". – Diagon Oct 15 '18 at 5:37
1

When you say "I have installed Ubuntu 18.04.1 with Full-Disk Encryption," I gather you installed Ubuntu with LUKS. You put in a password to decrypt your hard drive - except for the /boot sector which can not be encrypted if you want to be able to boot - and then you put in your login password for your username. In this case, once you have decrypted your disk, the Trash folder is visible/accessible, just as if you had never encrypted your disk. When you delete the files, they are deallocated, but still visible on the decrypted disk. So, as @b_laoshi suggests, you should shred your files if you want them to be gone.

1

If you're running a HDD in your machine, just securely erase the files you don't want them to access before handing the system over. If you're running an SSD, this may be pointless! ...

shred -uzn3 <path to your file>

or if you have a folder full of files you want to shred (this will dig into all subdirectories as well):

find <path to your folder> -type f -exec shred -uzn3 '{}' \;

Breakdown of the switches used:

  • -u: truncate and remove file after overwriting
  • -z: add a final overwrite with zeros to hide shredding
  • -n 3: overwrite 3 times

The only way to prevent similar data recovery for files that were previously deleted would be to overwrite all of your empty disk space. If you want to do that, try the script below. Beware that this could take a long time if you have lots of free space. Also, this may not work as intended with an SSD! Place this script in your home directory and run it.

#!/bin/bash
# desc: When run, this script fills the partition on which it resides with random or 
#   zero-filled files. Once filled all of the files generated are removed. Thus any 
#   existing date in the free space is overwritten.
# WARNING: because of wear-leveling techniques used by SSDs this may not work
#   as expected with SSDs and some data may remain recoverable.

useRandom=0 #using random data is MUCH slower!
[ $useRandom -eq 1 ] && readDev=/dev/urandom || readDev=/dev/zero
prefix="wipe"
# if we started and killed the script before, pick up where we left off
i=$(ls -l ${prefix}_*.filler 2> /dev/null | wc -l) || i=0

echo "Filling this filesystem. This could take a while ..."
# start an infinite loop writing 2G files to disk
while :
do
    # write (another) 2G file; break loop when no space is left
    dd if=$readDev of=${prefix}_$i.filler bs=4M count=512 > /dev/null 2>&1 || break
    let $[i++]
    # calculate values for displaying progress
    completed=$(ls -l ${prefix}_*.filler | awk '{print  $5}' | paste -sd+ | bc)
    free=$(df -PB1 . | tail -n1 | awk '{print $4}')
    percent=$(echo "scale=2; 100 / (1 + $free / $completed)" | bc)
    # show progress
    echo "Progress: $(numfmt --to si <<< "$completed") (${percent}%)"
done
# when no space is left, print out the 100% progress indicator and remove the zero-filled files
echo "Progress: $(ls -l ${prefix}_*.filler | awk '{print  $5}' | paste -sd+ | bc | numfmt --to si) (100.00%)"
echo "Finished filling partition! Cleaning up."
rm ${prefix}_*.filler

exit
0

Both the file and the file-in-Trash exist ONLY in the mind of the ecryptfs filesystem that has your encrypted $HOME directory mounted. The actual data that gets written to disk is encrypted and looks like binary garbage to the filesystem. When the ecryptfs instance unmounts your home directory, it forgets about your real files, and only leaves the encrypted binary garbage on the disk.

When another ecryptfs mounts your $HOME directory, file and file-in-Trash become visible.

When file-in-Trash is deleted, its blocks are put on the free space list of the ecryptfs filesystem. It, too, looks like encrypted binary garbage on disk.

If you share your "disk login" password, but NOT your "login" password, the technichian will have access to the encrypted copy of your $HOME directory, and ALL the system files outside your $HOME directory. The technician can trash your system, but not see your files.

  • 2
    A repair person with such access can make a disk image, replace system binaries to e-mail themselves your later-entered passwords, and then decrypt your home directory residing in their disk image. They can then see your files. They can also modify the trash function so that future trashed files are e-mailed to them. – Chai T. Rex Sep 24 '18 at 3:28
  • 2
    The OP says that installed with "Full Disk Encryption", meaning LUKS. That's not ecryptfs. – Diagon Oct 15 '18 at 4:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.