I recovered a lot of .eCryptfs files (88 670) using Photorec. Now I have an error when trying to mount them with ecryptfs (see here: https://askubuntu.com/questions/636764/ecryptfs-mount-wrong-fs-type-bad-option-bad-superblock)
First, it's important to underestand how ecryptfs works. The keypoint is that it is a file-system level encryption. It means that the encryption is contained in each file header, and so what we are trying te recover are the crypted files. Decrypting them will come after the recovery.
eCryptfs has 2 default mode in Ubuntu.
- One is crypting just the
- Second is crypting the whole
Here is how it works: The crypted files are stored in
/home/user/.Private for case 1 and in
/home/.ecryptfs/user/.Private for case 2 (
/home/user/.Private is then symlinked to
/home/.ecryptfs/user/.Private for case 2).
Because most user's password is less than 10 chars, ecryptfs use its own 32 chars passphrase to encrypt/decrypt the files and the path to the files. This passphrase is stored salted/hashed into a file called the wrapped-passphrase (located in
.ecryptfs, the one next to the
.Private folder). When the user log-in, it will mount the lower directory (
.Private, the crypted one) on the upper directory (the target,
Private in case 1,
/home/user in case 2). And when the user log-out, it is unmounted.
In case one day you need to mount your ecryptfs crypted folder from a liveUSB or from another computer, it is recommended that you save (in advance) the ecryptfs passphrase (as just using your account password is not always an option to mount the folders).
Mount image on loop0
Just after the cash, the first thing your did is creating a dd image of your disk. Now we boot on a liveUSB we will mount this dd image (stored in media/victor/externalDisk in my case). First need to check for the starting block of the Linux LVM partition (501758):
#fdisk -l media/victor/externalDisk/ss9backup.img
Disk /media/victor/blackWD/ss9backup.img: 128.0 GB, 128035676160 bytes
255 heads, 63 sectors/track, 15566 cylinders, total 250069680 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00026d62
Device Boot Start End Blocks Id System
/media/victor/externalDisk/ubuntu14.10.img1 * 2048 499711 248832 83 Linux
/media/victor/externalDisk/ubuntu14.10.img2 501758 250068991 124783617 5 Extended
/media/victor/externalDisk/ubuntu14.10.img5 501760 250068991 124783616 8e Linux LVM
Now I can mount the partition on the loop device, by specifying the [offset] = starting block  x block size .
losetup -o 256901120 /dev/loop0 /externalDisk/ubuntu14.10.img
256901120 is the offset.
Then display the result with
PV VG Fmt Attr PSize PFree
/dev/loop0 ubuntu-vg lvm2 a-- 119,00g 0
then activate with:
#vgchange -a y ubuntu-vg
2 logical volume(s) in volume group "ubuntu-vg" now active
and finally mount (read-only) the root partition (just to have a look inside to see what is left, but the recovery tools won't use this mount) with:
mount -o ro /dev/ubuntu-vg/root /mnt/Ubuntu14.10/
Once there, I can start working on my image as if it was a device (
/dev/ubuntu-vg/root) as most recovering program ask a device to recover from as an input.
I tried three recovering program, Extundelete, ext4magic and Photorec. This last one recovered the most .eCryptfs files
Here are the instructions to get started with photorec (credits to @Germar)
tar xvjf testdisk-7.0.linux26-x86_64.tar.bz2
sudo ./photorec-static /d /home/victor/Downloads/recovery_folder /dev/ubuntu-vg/root
Extundelete was not as good as Photorec, but you can give it a try. On your liveUSB booted Ubuntu, make sure that you have activated the universe repositories, and then run:
apt-get install extundelete
cd into a folder where you have plenty of space (recovered files will be copied there), and run this command (where /dev/ubuntu-vg-root is the partition you want recover files from, should not be mounted, or read only at most !!!) :
extundelete /dev/ubuntu-vg/root --restore-all --after `date -d 'Aug 16 02:35' +%s`
You can try to restrict the program to recover from a specific folder (
--restore-directory) or restrict to files deleted after a specific date (
--after), see all the command options.
After the program finish, look for recovered files with ECRYPTFS_FNEK_ENCRYPTED.XXXXX in the name. The more you have, the happier you are.
You can read this guy and this article who both had similar problem.
I personnaly didn't find many encrypted files, and all of have a very small size.
Decrypt the recovered files
Refer to this thread to help me tackle this last problem: https://askubuntu.com/questions/636764/ecryptfs-mount-wrong-fs-type-bad-option-bad-superblock
This is a wiki answer, please improve it!