1

I have a big problem! i accentually deleted a very imported folder in my home dir while creating a backup. I stopped the backup, shutdown the laptop, but there are still a lot of files to be backed up. So I am afraid of manipulating the encrypted home.

The home is encrypted via ecryptfs and the system Ubuntu 13.04.

I tried to use extundelete from a live usb stick. For the recovery the partition has to be unmounted but then home is encrypted and a recovery of the Document folder is not possible.

Can anybody give my an advise to to recover a folder inside the encrypted home?

The data is very imported because containing a dairy.

  • You should stop working on that volume immediately. Unmount or mount -o ro it. Do the recovery from a live system if necessary. – David Foerster Oct 22 '14 at 18:02
1

You're right in your assumption that you need to unmount the ecryptfs-encrypted file system. ecryptfs works on top of an underlying file system whereas undeletion tools like extundelete operate on ext file systems like the one you probably have underneath your ecryptfs file system.

You don't need access to the unencrypted document files to undelete them. Instead you'll undelete the encrypted files in ~/.Private or wherever your ecryptfs file system is located (not mounted).

For the actual undeletion procedure refer to other answers like:

  • Recovery is often difficult at best and encryption will make it more difficult. – Panther Oct 22 '14 at 13:17
  • It is a comment, not an answer. I do not think your suggestion is going to easily work due to encryption. – Panther Oct 22 '14 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.