ecryptfs has hidden some of my files

sonichedgehog · 11-27-2012, 07:24 PM

Hi
I have a load of encrypted files following an attempt to update my version of ubuntu
Ok I messed up- I thought that, since I had a separate /home directory, the distribution upgrade would leave it intact. In fact, it encrypted all the files.
I was unable to log in after the update failed.

I have since installed 12.04 from the iso, and it's fine. All other user files are untouched, as are the important files that I keep backed up. So I might have lost a few photos,no big deal.

I have the following in .ecryptfs/USERNAME:

Code:

$ ls -la
[USER][GROUP] 4096 Dec 14  2009 .ecryptfs
[USER][GROUP]  65536 Nov 25 01:03 .Private

[CONTENTS OF ECRYPTFS:]
auto-mount  auto-umount  Private.mnt  Private.sig  wrapped-passphrase

Directory Private contains all the encrypted files.
I used ext4magic on this, and it seems to have "unpacked" them - there is now a nest of layered files but nothing intelligible.

"wrapped-passphrase" can be seen using hexedit - I believe it contains a key.

Unfortunately, I know from messages that there is a broken link to a location in /usr/share, that has now been overwritten by the new OS.

I am ready to give up and move on and am 90% certain that this is best - as I say, there are unlikely to be any significant files lost.

But I would like to try and open these files if possible.

Has anyone encountered this before?

And in any case I would urge anyone reading this to note my mistake, and back up everything before a distribution upgrade, just as if you were installing a whole new OS.

Best regards to all

unSpawn · 11-27-2012, 08:56 PM

See links at https://www.linuxquestions.org/quest...4/#post4747327 ?

sonichedgehog · 11-28-2012, 01:56 AM

many thanks unspawn - apologies for not finding this on my LQ search, wrong search terms maybe. The solution in http://www.kubuntuforums.net/archive...p/t-58140.html looks very promising, I'll return to this thread when I've tried it.

sonichedgehog · 12-25-2012, 05:22 PM

Tried it, but it seems that there is no way to recover the passphrase required to mount the ecryptfs. I had wondered whether the file named wrapped-passphrase might actually contain the information, from the following hexedit:

Code:

00000000   62 33 34 38  35 66 31 33  33 34 66 64  36 64 32 31  b3485f1334fd6d21
00000010   5A 6B B7 E3  3E 0E 61 10  63 CA A6 BB  A3 56 ED 62  Zk..>.a.c....V.b
00000020   76 CF A3 1F  45 09 1C 8A  83 9D B0 53  A4 2C 6F 36  v...E......S.,o6

However the line from "b3" to "Zk" didn't work, with various attempts based on the link you suggested.

I suspect that this is lost somewhere in the earlier OS that is now overwritten - so unless anyone has a different suggestion I will consider it fortunate that there are copies of nearly all the lost files and put this down to experience - and wish all my fellow Linux users compliments of the season!

Phil