3

This is probably going to be a long post, but at the moment I cannot see the wood for the trees, so any help appreciated.

In a nutshell: the other night I changed my (login) password. Then forgot it. So I went in via a live CD and changed it as root. Also, when I changed my password originally, I used sudo (not that this should matter) as the normal user.

The (possible) saving grace is that I have a rough idea of what the password was - just can't seem to re-create it for the login passphrase for ecryptfs.

When I created my encrypted directory a couple of years ago, I recall writing the password I used at the time - it's a plain text English mixed password - for example it was written down on my piece of paper as (this isn't it BTW!):

HDD password: pa$$w0rd

I'd never really bothered with it since because I had this data written down. I am meticulous in recording digits, upper case etc., and even now recall the program I was watching that inspired me for the password. However, after having read several articles, it appears that the passphrase is actually a 32 byte string.

I have to admit I am confused, and require some pointers in trying to clear this up.

Point-by-point:

  • If I've lost my HDD password and login passphrase, I've read you can't get your data back. Is this even true in light of future developments in computing? What was difficult to crack 10 years ago is much easier now. This would apply to this situation, right?
  • Is there any way of recovering this, via security company or hacking (read:editing) the sources to (for example) get John the Ripper to go through all possible permutations to run in the sources of ecryptfs inside the ecryptfs process to try it that way?
  • is the HDD password I wrote down relevant? I've only ever encrypted a file system once, and can't recall how it was done - might my text password, pa$$w0rd, have been used in generating the text for the HDD password? Because whenever it prompts for the passphrase in ecryptfs-unwrap-passphrase, inputting pa$$w0rd does not work.
  • Should ecryptfs-unwrap-passphrase work with pa$$w0rd? It does not work and I know I wrote down pa$$w0rd for a specific reason...
  • Not sure why, but the files in /home/.ecryptfs/user/.ecryptfs/wrapped-passphrase and /home/user/.ecryptfs/wrapped-passphrase are the same. I thought they'd have been different (since the new user directory is based on a different password) - anyone shed any light on this?
  • Also, I can mount my home directory - and have a copy of the files (and their sizes) from a backup disk (shame I didn't do it recently!) - because of that, could I figure out from timestamps and file sizes the missing files, and possibly try to decrypt them individually?

I was so adamant in recording this phrase, pa$$w0rd, and can recall doing it, that I can't believe it's not working. Perhaps it was just my user password in the end...

Feel free to ask any pointed (or blunt!) questions, if you require more information. Petty sure I've lost the lot...

0

If the password you wrote down was the unwrapped passphrase, then you should be able to mount the data by using mount and specifying ecryptfs as the filesystem type, like so:

mount -t ecryptfs my_encrypted_data my_encrypted_data   # yes, you can use the same directory as a mountpoint.

Answer the questions accordingly (probably leave everything as default).

Use password managers and make backups.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.