0

As many Ubuntu users I use ecryptfs in order to protect encrypt my home directory.

I know that loggin into my system ecryptfs decrypts my files and symlinks them to the actual location of my home directory.

I was wondering what happens if someone just pulls out my hard drive from my system. Can he/she access my data becaus ecryptfs was not able to umount the decrypted file direcotry?

Improve this question

1 Answer 1

Reset to default
1

That's not quite how ecryptfs works. Your data is stored in an encrypted, obfuscated form on disk. (see ls -lL $HOME/.Private) ecryptfs mounts a stacked filesystem on top of your $HOME, and decrypts the files (data and metadata) on-the-fly, as you access the files through the ecryptfs filesystem (which uses the underlying ext4 (or whatever) filesystem on disk for data storage). The results of the ecrypts filesystem (files, metadata) exists ONLY in the virtual memory of the running system. If your disk is hot-unplugged, all that is taken away is the encrypted, obfuscated disk storage. Also, your computer will be unhappy.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .