LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Ubuntu
User Name
Password
Ubuntu This forum is for the discussion of Ubuntu Linux.

Notices


Reply
  Search this Thread
Old 11-27-2012, 08:24 PM   #1
sonichedgehog
Member
 
Registered: Oct 2007
Location: London UK
Distribution: Fedora Core 17
Posts: 298

Rep: Reputation: 32
ecryptfs has hidden some of my files - can they be recovered?


Hi
I have a load of encrypted files following an attempt to update my version of ubuntu
Ok I messed up- I thought that, since I had a separate /home directory, the distribution upgrade would leave it intact. In fact, it encrypted all the files.
I was unable to log in after the update failed.

I have since installed 12.04 from the iso, and it's fine. All other user files are untouched, as are the important files that I keep backed up. So I might have lost a few photos,no big deal.

I have the following in .ecryptfs/USERNAME:

Code:
$ ls -la
[USER][GROUP] 4096 Dec 14  2009 .ecryptfs
[USER][GROUP]  65536 Nov 25 01:03 .Private

[CONTENTS OF ECRYPTFS:]
auto-mount  auto-umount  Private.mnt  Private.sig  wrapped-passphrase
Directory Private contains all the encrypted files.
I used ext4magic on this, and it seems to have "unpacked" them - there is now a nest of layered files but nothing intelligible.

"wrapped-passphrase" can be seen using hexedit - I believe it contains a key.

Unfortunately, I know from messages that there is a broken link to a location in /usr/share, that has now been overwritten by the new OS.

I am ready to give up and move on and am 90% certain that this is best - as I say, there are unlikely to be any significant files lost.

But I would like to try and open these files if possible.

Has anyone encountered this before?

And in any case I would urge anyone reading this to note my mistake, and back up everything before a distribution upgrade, just as if you were installing a whole new OS.

Best regards to all

Last edited by sonichedgehog; 11-27-2012 at 08:27 PM. Reason: Also:private.sig contains a key, different to wrapped passphrase
 
Old 11-27-2012, 09:56 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
See links at https://www.linuxquestions.org/quest...4/#post4747327 ?
 
Old 11-28-2012, 02:56 AM   #3
sonichedgehog
Member
 
Registered: Oct 2007
Location: London UK
Distribution: Fedora Core 17
Posts: 298

Original Poster
Rep: Reputation: 32
many thanks unspawn - apologies for not finding this on my LQ search, wrong search terms maybe. The solution in http://www.kubuntuforums.net/archive...p/t-58140.html looks very promising, I'll return to this thread when I've tried it.
 
Old 12-25-2012, 06:22 PM   #4
sonichedgehog
Member
 
Registered: Oct 2007
Location: London UK
Distribution: Fedora Core 17
Posts: 298

Original Poster
Rep: Reputation: 32
Tried it, but it seems that there is no way to recover the passphrase required to mount the ecryptfs. I had wondered whether the file named wrapped-passphrase might actually contain the information, from the following hexedit:

Code:
00000000   62 33 34 38  35 66 31 33  33 34 66 64  36 64 32 31  b3485f1334fd6d21
00000010   5A 6B B7 E3  3E 0E 61 10  63 CA A6 BB  A3 56 ED 62  Zk..>.a.c....V.b
00000020   76 CF A3 1F  45 09 1C 8A  83 9D B0 53  A4 2C 6F 36  v...E......S.,o6
However the line from "b3" to "Zk" didn't work, with various attempts based on the link you suggested.

I suspect that this is lost somewhere in the earlier OS that is now overwritten - so unless anyone has a different suggestion I will consider it fortunate that there are copies of nearly all the lost files and put this down to experience - and wish all my fellow Linux users compliments of the season!

Phil
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to Recover Deleted Files when rm command was used (I recovered using ext3grep) rtoney5 Linux - Software 8 01-14-2013 06:19 AM
Copying files encrypted with ecryptfs newize Linux - Security 6 08-18-2012 12:42 PM
[SOLVED] photorec + .ecryptfs to restore files jamendo10 Linux - Security 4 08-07-2012 07:24 AM
[ECRYPTFS] ecryptfs_init_miscdev: Error whilst attempting to open [/dev/ecryptfs] nitinarora Linux - Kernel 0 03-22-2010 06:36 AM
bash: mv hidden and not hidden files lupe Linux - General 4 06-22-2009 02:27 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Ubuntu

All times are GMT -5. The time now is 12:41 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration