How can I mount/recover my ecryptfs-encrypted home?

Question

I recently found an old disk with files in my ecryptfs-encrypted home folder that I want to recover. However I cannot boot into the system as it does not boots not. I need to attach the old disk to my new computer and recover the files from the CLI.

How can I get access to my old files?

Answer 1

There are many posts out there, but non of them covered all the steps that were required for me to recover the files from my old home folder. In my case I attached the old disk to a VM, this should however work the same way on a physical machine too.

(When installing the original system I used the default partitioning schema where the home folder is placed onto a seperate partion. So this will be covered. If that is not your case, you can just skip the second mount of sdb4.)

With this steps I was able to recover my files: (My old login name is daniel remember that yours will be different)

1) Become root sudo -s

2) Attach the disk to the VM computer so you see the partions using:

$ lsblk
NAME   MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda      8:0    0   127G  0 disk
├─sda1   8:1    0   512M  0 part /boot/efi
└─sda2   8:2    0 126.5G  0 part /               <-- This is the root parition from my LIVE/current system
sdb      8:16   0 465.8G  0 disk
├─sdb1   8:17   0   512M  0 part
├─sdb2   8:18   0  31.3G  0 part
├─sdb3   8:19   0 131.9G  0 part                 <-- This is my old /-partition
└─sdb4   8:20   0 151.4G  0 part                 <-- This is my old /home-partition

3) Mount the old filesystem to /mnt and prepare everything for a chroot:

$ mount /dev/sdb3 /mnt/          <-- mount your original root
$ mount /dev/sdb4 /mnt/home      <-- mount your original home
$ mount --rbind /dev /mnt/dev    <-- prepare the chroot with the defaut sysfs-stuff
$ mount --rbind /proc /mnt/proc
$ mount --rbind /sys /mnt/sys

4) chroot into the old machine:

$ chroot /mnt
$ ls -lah /home/
total 32K
drwxr-xr-x  5 root   root   4.0K Nov 11  2016 .
drwxr-xr-x 51 root   root   4.0K Aug  7 10:06 ..
dr-x------  5 daniel daniel 4.0K Aug  7 09:51 daniel
drwxr-xr-x  3 root   root   4.0K Apr 26  2014 .ecryptfs     <-- here is my ecryptfs stuff
drwx------  2 root   root    16K Apr 26  2014 lost+found

5) Verify we have a wrapped-passphrase file. This file is required to login in with you original login-password. There is another thing called the passprase which I imagine is the raw key used to encrypt your files. While setting up ecryptfs the computer tells you to write down your passphrase, well I did not so I needed that file.

ls -l /home/daniel/.ecryptfs/
total 20
-rw-r--r-- 1 daniel daniel 8192 Aug  7 10:43 auto-mount
-rw-r--r-- 1 daniel daniel    0 Apr 26  2014 auto-umount
-rw------- 1 daniel daniel   13 Apr 26  2014 Private.mnt
-rw------- 1 daniel daniel   34 Apr 26  2014 Private.sig
-rw------- 1 daniel daniel   58 Jul  8  2016 wrapped-passphrase   <-- This file is important, make sure it exists and is not empty

6) Now using the wrapped-passphrase file, we can recover our passphrase using our login-password:

$ ecryptfs-unwrap-passphrase /home/daniel/.ecryptfs/wrapped-passphrase
Passphrase:
[ENTER YOUR LOGIN-PASSWORD]
<32 char alphanumerical all lowercase passpharse>

Now write down your passphrase. You probably won't need it but in case you do, you now have it.

7) Now we need to add our passphrase to the kernel keyring so the kernel can decrypt our files using that passphase:

$ ecryptfs-insert-wrapped-passphrase-into-keyring /home/daniel/.ecryptfs/wrapped-passphrase
Passphrase:
[ENTER YOUR LOGIN-PASSWORD]
Inserted auth tok with sig [254199733df62f80] into the user session keyring

8) Now, we want to mount our old files. To do that we need to become the original user using sudo:

$ sudo -u daniel bash
Signature not found in user keyring
Perhaps try the interactive 'ecryptfs-mount-private' <-- Just ignore this message, it cause the home has not yet been decrypted

$ whoami
daniel      <-- make sure you are the original user!

9) Now we can mount our home directory:

$ ecryptfs-mount-private
Enter your login passphrase:
[ENTER YOUR LOGIN-PASSWORD]
Inserted auth tok with sig [254199733df62f80] into the user session keyring

$ cd
$ ls
<All your old files should be there>

Congrats! You just mounted your ecryptfs-encrypted home folder and got access back to all your files. Enjoy!