I had an encrypted home dir in my Ubuntu partition (system and home together). I left the live usb plugged in and someone reinstalled Ubuntu over that partition.

I read all I could on the net about people with similar issues. First of all, I stopped using the affected hard drive (writing this from a Lubuntu live cd). Then I ran Photorec on the affected disk, without any filter (i.e. recover everything). The results are now sitting in an external disk.

Among all the files, I think it's the .eCryptfs ones I need. However, I only know my login password. I never wrote down the mount passphrase. I know I can recover it with just my login password if I find the wrapped-passphrase file.

However, Photorec didn't recover the original name of any file (I believe it names them according to the disk sector from which they were recovered). Moreover, all files are distributed among different directories (recup_dir.1 and so on).

Is my only choice to wade through the millions of txt files until I find wrapped-passphrase? I don't think I could recognize it, since most surely it's a byte stream and there might be millions of files like that...

EDIT: Just in case anyone was wondering, the version was 12.04 (which means the filenames were encrypted, IIRC)

EDIT2: I created an Ubuntu 12.04 virtual machine with the same user and password as my old system and enabled home dir encryption. Here's the resulting wrapped-passphrase file:

enter image description here

  • 1
    If I remember correctly r-linux is capable of file recovery with its actual name. So use it to recover wrapped-passphrase
    – totti
    Jun 19 '14 at 9:08
  • Can you upload/show a sample wrapped-passphrase file
    – totti
    Jun 19 '14 at 9:13
  • @totti, I will try r-linux as soon as I can and get back to you. Also, I edited my question adding a wrapped-passphrase sample. Jun 19 '14 at 15:37
  • what about r-linux. Try grep -inR --binary-files=text f2bbda0 from the root folder of recovered data.
    – totti
    Jun 23 '14 at 15:47
  • Sorry I disappeared on you guys, I came down with a bad flu. I tried grepping the rescued files, didn't find anything. It seems like all the recovered files have some extension; there are no plain binary files without extension like wrapped-passphrase. Then I downloaded r-linux and scanned my partition. It recognized only the current partition (overwritten) and a bunch of extra found files. If I browse them, they look just like the ones Testdisk recovered. And I can only browse them by type/extension. I looked for wrapped-passphrase using the Find Files tool but nothing was found. Ideas? Jul 4 '14 at 3:17

Since you possibly have the content of the missing wrapped-passphrase file, why don't you run a recursive grep on the files you rescued? I would suggest to start only with the first 16 characters, f...2.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.