All of the posts that I can find regarding encrypted-data recovery regard specific situations. I currently have functioning partitions and directories, but would like to maximise my chances of recovering data should something go wrong (in addition to my back ups). What information (such as keys, passphrases, configuration etc.) should I keep in cold storage given the following setup?

Ubuntu root is installed on a LUKS-encrypted drive. I have a second HDD that is also LUKS-encrypted and is set up to automatically mount upon login. Additionally my home directory is mounted with ecryptfs.

I know that for ecryptfs I should be storing the output of ecryptfs-unwrap-passphrase, but what should be done for each of the LUKS partitions? I vaguely remember that there is some other passphrase that should be stored in case particular partition header information is corrupted.

Thanks for your help. As an aside, should anyone be interested in the cold storage, I plan to simply create level H (high error correction) QR codes for printing to paper along with the actual data as text.

  • most any back up strategy will work, just encrypt your backup.archive – Panther Mar 15 '15 at 0:46
  • I mean beyond an external backup. What is required for me to be able to decrypt the partition? – Arran Schlosberg Mar 15 '15 at 6:37
  • Your data is decrypted when you log in. I would use the back up strategy of choice and encrypt you back up with an alternate technology. Backing up your data while it is still encrypted is asking for problems. – Panther Mar 15 '15 at 19:10
  • I think I'm wording the question incorrectly. Ignore the separate backup. In the event that I have a hardware malfunction and need to plug my disk into another computer, what information will I need to access the contents? – Arran Schlosberg Mar 15 '15 at 23:05
  • blog.dustinkirkland.com/2011/04/… – Panther Mar 15 '15 at 23:15

For LUKS, the only data that is critical for decryption is the LUKS header. The header can be backed up to a file with cryptsetup luksHeaderBackup and restored with cryptsetup luksHeaderRestore. See man cryptsetup:

luksHeaderBackup <device> --header-backup-file <file>

Stores a binary backup of the LUKS header and keyslot area.

Note: Using '-' as filename writes the header backup to a file named '-'.

WARNING: This backup file and a passphrase valid at the time of backup allows decryption of the LUKS data area, even if the passphrase was later changed or removed from the LUKS device. Also note that with a header backup you lose the ability to securely wipe the LUKS device by just overwriting the header and key-slots. You either need to securely erase all header backups in addition or overwrite the encrypted data area as well. The second option is less secure, as some sectors can survive, e.g. due to defect management.

luksHeaderRestore <device> --header-backup-file <file>

Restores a binary backup of the LUKS header and keyslot area from the specified file.

Note: Using '-' as filename reads the header backup from a file named '-'.

WARNING: Header and keyslots will be replaced, only the passphrases from the backup will work afterwards.

This command requires that the master key size and data offset of the LUKS header already on the device and of the header backup match. Alternatively, if there is no LUKS header on the device, the backup will also be written to it.

| improve this answer | |

Run ecryptfs-unwrap-passphrase at the terminal screen and write down the output for disaster recovery.

  1. type ecryptfs-unwrap-passphrase in the terminal screen
  2. it will prompted you with "Passphrase:", it wants your user login password
  3. The output will look like this example "1b6acbada5e3a61ebe324a4745e61ba8" the 32 character output is your "passphrase" you need to write down and store in a safe place.

To recover your data in the future follow this guide..


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.