LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (http://www.linuxquestions.org/questions/linux-security-4/)
-   -   Decrypting my home directory ffolder (http://www.linuxquestions.org/questions/linux-security-4/decrypting-my-home-directory-ffolder-4175442240/)

fagin 12-19-2012 08:45 PM

Decrypting my home directory ffolder
 
Hi,

I need to recover my home directory files from Ubuntu via my Windows 7 (dual OS boot) using ext2read or ext2Fsd, but it won't read the encrytpted files in home directory.


3 days ago, my computer stopped booting into Ubuntu. The screen keeps going black at login. All I can do is CTRL-ALT-F1 and login from there. So I can access the username@username:~$

How can I decrypt my home directory using the username@username:~$ commands? I figure that once it is done ext2Fsd will be able to display them. And then I can recover them from there.

I don't know how to use the username@username:~$, so please be as detailed as possible.

Thank you very much for your help.

p.s.
( I decided to switch to Ubuntu 2 year ago. When I first installed it, I opted to encrypt my home directory. I have since lost my encrytption password).

Noway2 12-20-2012 10:28 AM

I have only had to perform this procedure once and the net result was that I was able to access my files which I quickly copied elsewhere and then rebuilt the user account. It was not a pleasant experience and required a bit of trail and error.

First, I doubt you are going to be able to do much from Windows because you will need access to tools like ecryptfs, which Windows lacks. Instead, a much better approach would be to use an Ubuntu livecd. Once you can boot your system via the CD, I would highly recommend making a backup of your home partition and would suggest using DD to make an image and keep if safe. USB hard drives, which have lots of storage are good for this purpose.

Second, when you encrypted your file system, you should have had what is called the unwrapped password, or the mount passphrase. This how-to looks like it provides a pretty good overview of the process and more examples can be found by googling "ubuntu recover encrypted home". At a minimum, these should give you a starting point and things to try as well as a lot more step by step detail that one can easily put in a forum response post. Start with these documents and if you run into trouble, please respond with information regarding what step(s) you were performing and what results you were or were not getting.

fagin 12-20-2012 01:39 PM

Thanks Noway2. I tried using the live cd - it doesn't work.

The problem I'm having was originally posted here: http://www.linuxquestions.org/questi...9/#post4851315

After all is said and done, all I want to do is recover my files in HOME and my Thunderbird files and emails. I don't want to have to buy new hardware.



Now, following the link you gave me I was able to recover my Mount Passphrase. So I have two things at my disposal -- I can log in and get to the username@username:~$ (by CTRL-ALT-F1) and I have the Mount Passphrase. Couldn't I simply transfer everything in my HOME folder to my external hard drive by manually entering commands? Or can I decrypt my HOME directory from there?

I will continue researching the internet and read everything on that link you sent me.

Noway2 12-20-2012 02:57 PM

What part about a live CD didn't work? Are you able to run the PC on CD? Based upon the information in your other thread, especially the part where you state that Windows in non safe mode and Ubuntu are both failing, I agree that you have a hardware problem with the machine.

If you are able to get a command prompt for login (CTRL-ALT-F1), you may be able to do what you need to do. One advantage of the live CD that you may not have is the ability to elevate to root privilege which may be required to "mount" drives. With the encrypted home partition, your home folder is stored as a file in another part of the file system in encrypted format. When you login, this file is supposed to auto mount to your home folder location. Something clearly has gone wrong and you are not able to fully login, mount it, etc.

Since you can get to the drive, I would suggest that you do the following items:
1) use fdisk -l to see what partitions it is showing. Hopefully you see at least one "Linux" partition. If you see more, your /home folder should be on one of these.
2) once you determine what partitions you have, you need to locate the .Private folder. Mount the partition and use:
Code:

sudo find / -type d -iname '.Private' 2>/dev/null
3) you need to find the keyring key
Code:

sudo ecryptfs-add-passphrase --fnek
, which requires the MOUNT passphrase you obtained.
4) next you need to mount your encrypted home directory (mount -t ecryptfs, for mount type encrypted file system) to a desired location. You will need the pass phrase again. You will also be prompted for a few parameters. I would follow what is in the how to document.

Whether or not you are able to do this with the username@username prompt will depend upon whether you can see the partition with /home and whether or not you can gain sufficient privilege to mount the volumes. If your lucky, sudo will work for you.

fagin 12-20-2012 05:56 PM

Noway2, thanks alot for your help.

I was able to locate my linux partition - it's /dev/sda5.

I am persisting in thinking that it is a software issue even though it is sounds like a hardware issue and that only because - just before it broke down I had installed "questionable" softwares both on Windows and on Ubuntu...it just doesn't feel right.

Anyway,

I have to power off my brain for now - whiuch is running on a winter season's flu state.

Will, get back to post more updates tomorrow.

thanks again, for your help.

p.s. I am REALLY a newbie and has to find step by step instructions like : "Ok first you type this" : "command", "then you will see this, then you type this....then you type this"....

sorry I don't expect you to go through all that....I hope I'll be able to find it on my own on the net.

fagin 12-24-2012 12:00 PM

Hello, am back to say that this issue is resolved - solution shown in the post of the original problem here:
http://www.linuxquestions.org/questi...en-4175441879/


All times are GMT -5. The time now is 05:24 AM.