I have a big problem. When I made a upgrade from 10.10 to 11.04 I lost all my data in home directory. I have only data from my home encrypted directory. What can I do? Thanks Martin

  • Hi! Open a terminal, type ls -a ~, then copy-paste to your question the output only. (Please use <pre> HTML tag!) – antivirtel Apr 30 '11 at 7:36
  • 1
    First of all, do not use the disk until you've figured out what went wrong. Use a LiveCD for browsing and mount partitions read-only if you need to read files from it. – Lekensteyn Apr 30 '11 at 7:37
  • @B. Roland: indent it with four spaces rather than using a <pre> tag. – Lekensteyn Apr 30 '11 at 7:37
  • why is it better? every line you have to add 4 space, <pre> is simple... – antivirtel Apr 30 '11 at 8:16

I solved the problem.

Make a backup all encripted data to *.tar file.

Find hidden password for an encrypted directory - passprase or you find out:

ecryptfs-unwrap-passphrase /home/oldusername/.ecryptfs/wrapped-passphrase

Create a new user with an encrypted home directory (check in the selection).

Log in as a new user, then follow this instructions: Recovering your data in this address in https://help.ubuntu.com/community/EncryptedPrivateDirectory

(sudo mount-t ecryptfs /home/oldusername/.Private /home/username/Private) and finally log to directory Private as root privilage.

Many success Martin

| improve this answer | |

This is a very simple method based on this blog using a 11.04 or 11.10 live cd/usb or if you dual boot a 11.04/11.10 install


It does require you know the login password of the user whose encrypted directory is to be recovered. If the username is also known then the copying the recovered files can be greatly simplified, (no reason it shouldn't be known), so will lay the method out first.

If you don't know your wrapped-passphrase

You may be able to recover it by decrypting the file /home/username/.ecryptfs/wrapped-passphrase using your login passphrase.

Step 1

$ sudo ecryptfs-unwrap-passphrase /home/username/.ecryptfs/wrapped-passphrase

Step 2

Type your login passphrase to reveal the mount passphrase it was unable to

For live cd/usb

Boot to the live cd/usb, choose the Try me option. Once on the Desktop click on the power cog indicator > System Settings > User Accounts. If a password is requested just press enter on the keyboard. (no password

Create a new user, use the exact same name as the user whose directory is to be recovered. Click on Account type, pick Administrator. Once created click on "Account disabled" & enable the account. The password doesn't matter, 123456 or whatever is accepted will do.

If using an 11.04 live cd/usb open a terminal & run this command, .on 11.10 or newer no need to

gconftool-2 -s -t bool  /apps/indicator-session/suppress_logout_menuitem false

Now log out & at the login screen pick the new user, login. Once logged in open nautilus and mount the parition where the encrypted directory is. Then open a terminal & run this

sudo ecryptfs-recover-private

It may take a bit to find, when prompted, if the directory found is the one desired then choose y

When prompted for a " LOGIN passphrase" use the password of the user whose encrypted files are to be recovered

Here is an Ex.

doug@ubuntu:~$ sudo ecryptfs-recover-private 
INFO: Searching for encrypted private directories (this might take a while)...
INFO: Found [/media/03b449b1-3c0b-481d-a917-afeb3e528a5a/home/.ecryptfs/doug/.Private].
Try to recover this directory? [Y/n]: y
INFO: Enter your LOGIN passphrase...
Inserted auth tok with sig [4b308179ad1441de] into the user session keyring
INFO: Success!  Private data mounted read-only at [/tmp/ecryptfs.NgZaH4ds]. 

Now browse to /tmp, you will be the owner of the ecryptfs.XXXXXXXX directory & can freely view & copy any files

From a dual boot

Basically the same .. A few diff.'s, login to your admin acount

Install ecryptfs-utils

sudo apt-get install ecryptfs-utils

Then same as above, create a new user with the exact same username as the user whose files are to be recovered, login to the new user, mount the partition, run the command, ect.

If for some reason do not wish to recover from an exact same username

Then you can dispense with creating that user & if on on 11.04 live cd/usb no need to change the gconf setting. Otherwise the same as shown above for either live session or dual boot recovery.

The main difference is you'll need to be root to view the recovered files & you'll need to copy any files to a root owned directory. After copying they then can be transferred as normal

One suggested way to view & copy

sudo mkdir /tmp/backup; gksudo nautilus /tmp/backup

Then open another root browser (gksudo nautilus) either from a 2nd terminal or Alt+F2, browse in it to /tmp/the_recovered_directory

Copy whatever you wish to /tmp/backup, then you will be able to copy from /tmp/backup as 'normal'

| improve this answer | |

Short method is find your real home folder in /home/USERNAME/.Private/ There go to .ecryptfs folder. Here you can see settings files needed to recover your home folder. (if don't then may be something went wrong) You must have a passphrase first. This is different from the one you used to login to your PC. In a terminal enter:

ecryptfs-unwrap-passphrase /home/USERNAME/.Private/.ecryptfs/wrapped-passphrase

Then enter your login password. It will show you an important momble jumble word! For now I call it secret1.

Then find the file Private.sig there. If you cannot find that file (Why?) you can run this:

ecryptfs-add-passphrase --fnek

When it asked you, enter secret1. Consider momble jumble letters from second line of either Private.sig file or output of this command as secret2. I will use it later.

Then run:

mount -t ecryptfs /home/USERNAME/.private/.Private /mnt

Enter secret1 as passphrase. Answer all questions by pressing enter EXCEPT:

Answer "Enable filename encryption " with y Answer "Filename encryption key (FNEK)" with secret2

Here we are. Now go to /mnt and see your files. If you still see momble jumble worlds, then you may forget something or..., I don't know

| improve this answer | |
  • i think this would be helpful.but too long – twister_void Nov 10 '11 at 8:26
  • your usernames and stuff were backwards so I fixed them, can you give this answer a once over again? I am confused on what's supposed to be .private and what is supposed to be .Private – Jorge Castro Jul 19 '12 at 20:36

Standard method

From the graphical desktop, click on: "Access Your Private Data"


From the command line, run:


mount method

cd home # Go to the folder which contains hidden .ecryptfs folder.
USER=$USER # Change it, if your username is different than the current.
SIG1=$(head -n1 .ecryptfs/$USER/.ecryptfs/Private.sig) # Load your 1st signature from the file.
SIG2=$(tail -n1 .ecryptfs/$USER/.ecryptfs/Private.sig) # Load your 2nd signature from the file.
echo Your pass:; PASS=$(ecryptfs-unwrap-passphrase .ecryptfs/wrapped-passphrase | sed s/Passphrase:\ //) # Enter your passphrase, repeat if necessary.
echo $PASS $SIG1 $SIG2 # Verify presence of all 3 hashes.
echo $PASS | sudo ecryptfs-add-passphrase --fnek # Add pass to user session keyring for sig specified in mount option.
sudo mount -t ecryptfs -o key=passphrase,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_passthrough=no,ecryptfs_enable_filename_crypto=yes,ecryptfs_sig=$SIG1,ecryptfs_fnek_sig=$SIG2,passwd=$(echo $PASS) $USER/.Private /mnt
Attempting to mount with the following options:

Or you can check the following scripts:


You can recover the "real" passphrase with tool ecryptfs-unwrap-passphrase, e.g.

ecryptfs-unwrap-passphrase wrapped-passphrase

This tool will ask for "passphrase" which in this case is the same as "login passphrase" which actually is the old login password.

See Daemon Challenge 2: We have a Winner! or Re: How best to crack wrapped-passphrase? for some brute-force attack suggestions.

See also:

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.