1

I have encrypted data on an external HD mounted on /home/username/.Data. I am trying to decrypt it to /home/username/Data.

Although I can successfully read the files contents, I cannot manage to decrypt the filenames.

Here is what I am trying:

$ sudo ecryptfs-add-passphrase --fnek
Passphrase: 
Inserted auth tok with sig [aaaaaaaaaaaaaaaa] into the user session keyring
Inserted auth tok with sig [bbbbbbbbbbbbbbbb] into the user session keyring

$ sudo mount -t ecryptfs /home/username/.Data /home/username/Data        
Passphrase: 
Select cipher: 
 1) aes: blocksize = 16; min keysize = 16; max keysize = 32
 2) blowfish: blocksize = 8; min keysize = 16; max keysize = 56
 3) des3_ede: blocksize = 8; min keysize = 24; max keysize = 24
 4) twofish: blocksize = 16; min keysize = 16; max keysize = 32
 5) cast6: blocksize = 16; min keysize = 16; max keysize = 32
 6) cast5: blocksize = 8; min keysize = 5; max keysize = 16
Selection [aes]: 
Select key bytes: 
 1) 16
 2) 32
 3) 24
Selection [16]: 2
Enable plaintext passthrough (y/n) [n]: 
Enable filename encryption (y/n) [n]: y
Filename Encryption Key (FNEK) Signature [aaaaaaaaaaaaaaaa]: bbbbbbbbbbbbbbbb
Attempting to mount with the following options:
  ecryptfs_unlink_sigs
  ecryptfs_fnek_sig=bbbbbbbbbbbbbbbb
  ecryptfs_key_bytes=32
  ecryptfs_cipher=aes
  ecryptfs_sig=aaaaaaaaaaaaaaaa
  Mounted eCryptfs

Now I am using Ubuntu 14.04.1 LTS and ecryptfs-utils 104-0ubuntu1. The external HD was encrypted some months ago, with an older version of Ubuntu.

Any ideas on how to solve it?

EDIT:

Some days latter, I have tried something different. I have run ecryptfs-setup-private which creates a ~/.Private and a ~/Private directories.

Then I have logged out, logged in, umounted ~/.Private using ecryptfs-umount-private, copied a directory from the external HD to ~/.Private and mounted it again using ecryptfs-mount-private.

This way, the directory name was correctly decrypted. However, I cannot read it or change the current directory to it.

$ cd decrypted_dir_name
bash: cd: decrypted_dir_name: No such file or directory
$ ls -l
d????????? ? ?      ?         ?            ? decrypted_dir_name
1
  • What should I have done, instead of just repeating the question on Ask Ubuntu, if nobody answered at Super User and it seemed more likely to have an answer on the former one?
    – toliveira
    Jan 19, 2015 at 9:59

2 Answers 2

0

UPDATED INFO:

Just noticed the probable problem buried there: You said "The external HD was encrypted some months ago, with an older version of Ubuntu."

Newer versions of eCryptfs do not always work on data encrypted with older versions. It's not fully backwards-compatible. You should decrypt the data using the original version that encrypted it.

Or, it's possible you're not using the right key for the filename encryption (fnek), double-check the key and look into the mount options ecryptfs_fnek_sig=(fnek_sig) and even ecryptfs_sig=(fekek_sig).

Here are some mount -t ecryptfs options that look useful (from man ecryptfs):

ecryptfs_sig=(fekek_sig)
      Specify  the  signature  of the mount wide authentication token.
      The authentication token must be in the  kernel  keyring  before
      the  mount  is performed. ecryptfs-manager or the eCryptfs mount
      helper can be used to construct the authentication token and add
      it to the keyring prior to mounting.

ecryptfs_fnek_sig=(fnek_sig)
      Specify  the  signature  of  the mount wide authentication token
      used for filename crypto. The authentication must be in the ker‐
      nel keyring before mounting.

 ecryptfs_enable_filename_crypto=(y/n)
      Specify whether filename encryption should be enabled.  If  not,
      the  mount  helper  will  not  prompt  the user for the filename
      encryption key signature (default).

  verbosity=0/1
      If verbosity=1, the mount helper will ask you for missing values
      (default).  Otherwise, if verbosity=0, it will not ask for miss‐
      ing values and will fail if required values are omitted.

I think you will probably find the ecryptfs-recover-private tool a lot easier than manually specifying encryption & filename keys... if you have a "regular" encrypted folder it should work pretty good, pointing it at the encrypted drive's ".Private" folder should work, maybe /home/username/.Data if that's it.

Here's a paste from it's man page:

NAME
       ecryptfs-recover-private  - find and mount any encrypted private direc‐
       tories

SYNOPSIS
       ecryptfs-recover-private [--rw] [encrypted private dir]

DESCRIPTION
       This utility is intended to  help  eCryptfs  recover  data  from  their
       encrypted  home  or  encrypted private partitions.  It is useful to run
       this from a LiveISO or a recovery image.  It must run under sudo(8)  or
       with root permission, in order to search the filesystem and perform the
       mounts.

       The program can take a target encrypted directory on the command  line.
       If  unspecified,  the utility will search the entire system looking for
       encrypted private directories,  as  configured  by  ecryptfs-setup-pri‐
       vate(1).

       If  an encrypted directory and a wrapped-passphrase file are found, the
       user is prompted for the login  (wrapping)  passphrase,  the  keys  are
       inserted into the keyring, and the data is decrypted and mounted.

       If  no  wrapped-passphrase file is found, the user will be prompted for
       their mount passphrase.  This passphrase is typically 32 characters  of
       [0-9a-f].  All users are prompted to urgently record this randomly gen‐
       erated passphrase when they first setup their encrypted private  direc‐
       tory.

       The  destination  mount of the decrypted data is a temporary directory,
       in the form of /tmp/ecryptfs.XXXXXXXX.

       By default, the mount will be read-only.  To mount with read and  write
       permission, add the --rw parameter.
10
  • That seemed a good idea. I tried it but I got the same result I had gotten using ecryptfs-mount-private as described in the question. That is, the directory name was correctly decrypted. However, I cannot read it or change the current directory to it. ` $ ls -l ls: cannot access decrypted_dir_name: No such file or directory total 0 d????????? ? ? ? ? ? decrypted_dir_name`
    – toliveira
    Jan 6, 2015 at 17:20
  • After using ecryptfs-recover-private did you look in your /tmp folder for a directory similar to /tmp/ecryptfs.XXXXXXXX? That's where it's supposed to mount the decrypted foler
    – Xen2050
    Jan 6, 2015 at 19:10
  • I am sorry, my comment was not clear. The decrypted folder was mount on /tmp/ecryptfs.XXXXXXXX and it had its right decrypted name decrypted_dir_name. However, I cannot read /tmp/ecryptfs.XXXXXXXX/decrypted_dir_name or change the current directory to it. I get the same problem as described after the "EDIT" on the question (please refer to it as the formatting options of the text are better there).
    – toliveira
    Jan 6, 2015 at 20:35
  • There may not be an exact decrypted_dir_name inside of /tmp/ecryptfs.XXXXXXXX/, just the decrypted files & folders, whatever their names are. Can you see anything at all in ``/tmp/ecryptfs.XXXXXXXX/` after running ecryptfs-recover-private? Looking as regular user, or as root?
    – Xen2050
    Jan 6, 2015 at 21:26
  • I see as many decrypted_dir_name as there were folders in the first level of the encrypted HD. There were no files in this level. For each of these folders, even as root, I see the following access permissions/owner/group/size/mtime: "d????????? ? ? ? ? ?". If I try to cd into one of them, I get the error: "No such file or directory". Mounting with "sudo mount -t ecryptfs" allows me to read their contents and open every file (text, pictures, sounds) but then I don't have the filenames decrypted.
    – toliveira
    Jan 7, 2015 at 21:15
0

I've had the exact same behaviour and the problem was just that I didn't select the right source directory.

Here's my disk's setup :

/mnt/usbdisk/Private/
          |-- Dir1
             |-- ECRYPTFS_FNEK_ENCRYPTED.FWa.AAAAAAAAAAAAAAAAA---
             |-- ECRYPTFS_FNEK_ENCRYPTED.FWa.BBBBBBBBBBBBBBBBB---
             |-- ECRYPTFS_FNEK_ENCRYPTED.FWa.CCCCCCCCCCCCCCCCC---
             ...
          |---Dir2
             |-- ECRYPTFS_FNEK_ENCRYPTED.FWa.DDDDDDDDDDDDDDDDD---
             ...

I've created 2 plain not-name-encrypted directories (Dir1 and Dir2) in the unmounted Private directory to better organize my files. They were supposed to also appear in clear whenever Private was mounted.

However trying to mount directly /mnt/usbdisk/Private got me the same result as you (lots of ???????). I got my files back by mounting /mnt/usbdisk/Private/Dir1 and /mnt/usbdisk/Private/Dir2 as sources.

I still don't have the answer and I hope you've got a solution since it's a very old post ;-) Did I made a change that I don't remember ? Maybe something to do with ecryptfs_passthrough option (although I've played with it and got no difference) ? Maybe because it's been months since the last time I plugged the disk in ?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .