1

So I did an interesting thing. I inadvertently copied an old version of my /home directory onto my current /home directory. I'll call these files Bad files. My home partitions are encrypted, and this action overwrote my current .ecryptfs information. All of the original encrypted files are still there, along with the copied Bad files. I'll call these files Good files - they are the newest files, that I'm trying to recover.

The Good files do not get decrypted. I'm guessing ecryptfs has a database over what files it should decrypt. So my home directory is flooded with ECRYPTFS_FNEK_ENCRYPTED files and folders.

I haven't changed my password, and it looks like I have a recorded passphrase as well.

Now, one of these encrypted files is the only copy of a video of my son standing for the first time. It happened quite recently, and it hasn't gotten backed up yet. So I'm going to spend some time trying to decrypt these files.

Now, what I'm wondering is this: Does anyone know how to decrypt these files one by one? And, with a bit more hope added, is there any way to scan the .Private folder and add all files?

EDIT: I just realized I've changed UID's since the "bad files" were made. Not sure if there's a solution in that fact.

  • 1
    Have a backup copy of the actual ecryptfs mount key? The one that's inside the wrapped-passphrase (I think that's what it's called) file? – Xen2050 Feb 15 '16 at 16:38
  • Possibly. I'm not sure - are they always workstation-specific? I've been moving this home directory from computer to computer. As long as I keep the same login & password, I can always just copy the .ecryptfs directory into the new installation (while logged out). And I know I have a passphrase, from my previous laptop. I'll test if I can work with that... – eira wahlin Feb 15 '16 at 17:37
1
  1. First, if the data's important I'd make a backup copy of everything before attempting to restore (& overwrite) any more files.

If I understand correctly, you've overwritten only some of your encrypted home files, with old backup copies from a different user & system? I'm not sure if or how well this can be recovered...

Each time an encrypted home is set up with eCryptfs it uses a new (pseudo) random "MOUNT passphrase" which is encrypted (wrapped) with your login passphrase. Using the same login passphrase on different systems wouldn't help with decrypting files if the wrapped-passphrase file has been overwritten or lost, since each encrypted home is supposed to have a different mount passphrase. (The ecryptfs-migrate-home script advises to record the mount passphrase ASAP, but I don't think most users see the warning if Ubuntu automatically sets up their encrypted home).

If you've only set up the encrypted home once and have been copying that to each new system, they all should use the same mount passphrase. But then I'd kind of think that all the files should already be decrypting correctly...

If you have a backup copy of the wrapped-passphrase file from that same system, or the actual mount passphrase, then the following should work to decrypt some files...

  • Try the ecryptfs-recover-private program/script, it will search for any .Private folders (or a specified folder) and attempt to find a wrapped-passphrase or mount passphrase and decrypt the files.

If it doesn't work as-is, you could try using a backup copy of the wrapped-passphrase file for that user & system, it should have the correct mount passphrase.

Or, if it has trouble finding the wrapped-passphrase file, you could always run ecryptfs-unwrap-passphrase on the correct wrapped-passphrase file, then use the resulting mount passphrase with ecryptfs-recover-private.

All of the eCryptfs tools should work well from a live dvd/usb, or just another user on the same system, but I'm not too sure what they do if there's multiple encrypted (.Private) folders. And most of the tools are just bash scripts, so if you want more details or to try it yourself just take a look, for example with less $(which ecryptfs-recover-private)

And there's also the verbose option that could be used with mount directly, it might have some info on why it's not decrypting a few files, but it also warns "Do not run eCryptfs in verbose-mode unless you are doing so for the sole purpose of development, since secret values will be written out to the system log" so I'd only try it when running from a live DVD/USB (where log files are only in RAM & lost on reboot).

| improve this answer | |
  • Victory! I tried just re-wrapping the directories with the recorded passphrase, but that didn't help - I got the same old data. Then I removed the bad /home/.ecryptfs/mysuser/.ecryptfs directory, that holds the wrapped passphrase, and ran ecryptfs-recover-private. And there it is! All data (and videos) recovered! Eternally grateful <3 – eira wahlin Feb 15 '16 at 19:41
  • In the end, I successfully rebuild the .ecryptfs info, and could reuse the .Private directory without moving any files. The reason that I didn't succeed rewrapping the passphrase was that the .ecryptfs/Private.sig files were overwritten. However, these can be regenerated. I moved my home and .Private directories to a temporary backup location. Then made a new, empty home directory. Encrypted that with ecryptfs-setup-private. This gave me a working ~/.ecryptfs directory. Then I just had to move the Private.sig to the backed up directory, rewrap with the correct passphrase, move back and reboot. – eira wahlin Feb 17 '16 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.