Before I begin, I want to make it clear that I understand very well that what I have done was a huge mistake on my part. That said, I already feel the extreme pain of my mistake, and understand better than ever how important it is to keep backups of encryption keys.

Here is the situation:

  1. My hard drive and home folder were encrypted via the options to do so when installing Ubuntu.
  2. I have been automatically backing up my home folder via the default Ubuntu "Backups" GUI program to a flash drive.
  3. I set up backups to be encrypted.
  4. I saved my encryption password in a plain-text file in my home folder (you may see where this is going).
  5. I decided to do a clean install of Ubuntu on my computer.
  6. I went through the process of installing Ubuntu from a live startup disk, manually creating a new partition table, with primarily one large, encrypted partition. I did not do any kind of intense data-erasure.
  7. I went to recover a backup from my flash drive, only to be prompted to enter an encryption password. I made over a year ago. That is 32 characters long. Contains letters, numbers, and symbols. And was randomly generated by a password-generation tool.

My only hope is that the portion of the disk where the plain-text file containing my encryption password was not overwritten. I realized my mistake very quickly, so I have been careful and am only running Ubuntu from my live startup disk. I know the password to the encryption that was on my hard drive.

What can I do to try to recover this file?

  • It is a long shot, but you could try: 'sudo dd if=/dev/sda3 | strings'. This will give you a lot of (ASCII) output, so you might want to mount an USB disk to capture the output. PS. sda3 is my / disk, replace accordingly. – user680858 May 30 '17 at 7:25
  • @WillemK if I do that (and am able to get the output I am looking for) what would I then to do decrypt it? – foxyjacob May 30 '17 at 7:31
  • Ow.. I misread. I thought you were looking for the password. – user680858 May 30 '17 at 7:34
  • @WillemK I am! That is all that really matters to me. But I am assuming that the output from that command would give me encrypted data. – foxyjacob May 30 '17 at 7:38
  • I'm afraid you're screwed. IIRC, the LUKS encryption uses a symmetric key stored in the encrypted volume's first few blocks of the partition. This symmetric key is used to quickly de- and encrypt your actual data. It is not stored plainly though but encrypted with your passphrase as asymmetric key, which is stronger but slower. One feature of this method (and in your case, the reason why your data is doomed), is that you can pretty securely wipe the whole volume by just overwriting the symmetric keys in the volume header. I don't think you can restore your textfile from the hdd. – Byte Commander May 30 '17 at 7:50

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.