Ubuntu
ecryptfs-utils package

File recovery via testdisk / photorec

Asked by tmg

Dear developers and users,

I've searched a lot around the web, but didn't find any satisfying answer.
Consider the following situation:

- You have your home directory /home/≤user> encrypted with ecryptfs
- You know your passphrase, that is, no trouble to decrypt the directory

Question: How do you recover deleted files from the mounted (decrypted) home
or the ecryptfs container?

All the ecryptfs recover strategies I've read so far were like
- use a livecd
- go and fire ecryptfs-recover-private, and mount your home readonly
- copy your files to a save place

But what about files that I can't regularly copy, because they are deleted?

If it was an unencrypted ext4, I would do (using ubuntu)
$ dd if=/dev/sda of=/media/user/sda.img
$ testdisk /media/user/sda.img

Can we run testdisk on the .ecryptfs container, or even the mounted home?

Thank you for any suggestion and best regards,

TMG

Question information

Language:
English Edit question
Status:
Expired
For:
Ubuntu ecryptfs-utils Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
actionparsnip (andrew-woodhead666) said : 		#1

Why not just use your backups. You do make backups, right?

Revision history for this message
tmg (t-m-gerlach) said : 		#2

Hello,

yes, I do make backups. But that's not the answer to my question. I'd like to know if r recovery is possible in the first place.

Thanks,

tmg

Revision history for this message
actionparsnip (andrew-woodhead666) said : 		#3

You can mount an encrypted file system from live CD/USB, using something like this:

http://askubuntu.com/questions/63594/mount-encrypted-volumes-from-command-line

But why bother when you have backups. The whole idea of a backup is that you can get your data back if necessary.

Revision history for this message
tmg (t-m-gerlach) said : 		#4

Thank you for the link.
I'm already aware of how to mount encrypted devices (both LUKS and ecryptfs).

Still, that's not what I'm looking for. I appreciate your help, but I dont't want to discuss the neccessarity of backups in this thread.

Thanks again,

tmg

Revision history for this message
actionparsnip (andrew-woodhead666) said : 		#5

Once you mount the file system in Live CD / USB you should be able to copy the data.

Revision history for this message
tmg (t-m-gerlach) said : 		#6

Yes, I understand. But again, this is not the answer to my question.
Suppose the following:
I have successfully decrypted and mounted the home folder via LiveCD/USB. Now I want to copy things, but I accidentally delete a file before I had a chance to copy it.

How do I recover it from the home folder (not using backups)..?

Revision history for this message
tmg (t-m-gerlach) said : 		#7

Ok, I got a hint from the guys at irc://irc.oftc.net/ecryptfs
Thank you, I will try and check and report my results here...

Revision history for this message
tmg (t-m-gerlach) said : 		#8

...they say, basically, you have to recover the ecryptfs files residing in you (unmounted!) home. Once you've got them, you can decrypt them and recover the files inside...

Revision history for this message
Launchpad Janitor (janitor) said : 		#9

This question was expired because it remained in the 'Open' state without activity for the last 15 days.