46

I installed a fresh Ubuntu 10.10 onto a new hard drive and want to mount the old home directory to a subdirectory of my new (also encrypted) home directory.

I tried this with sudo mount -t ecryptfs /mnt/oldhome/me/ /home/me/oldhome, with /mnt/oldhome being the /home partition of the old system.

Afterwards ~/oldhome contains a desktop link file (Access-Your-Private-Data.desktop) linking to ecryptfs-mount-private and a README.txt saying I should run ecryptfs-mount-private. I do so, but as I don't know what is supposed to happen, I can't tell if it happens and if it brings me closer to accessing my old home.

Any hints?

update

I was able to mount my old encrypted home with the help of this script. Though, looking into it with ls, I get alot of errors like this:

ls: cannot access /mnt/oldme/some_file: No such file or directory

Other information ls -l should show, is replaced by question marks.

update 2

I mounted the old system to /mnt/oldroot and mount /dev, /sys, /proc and the old home partition into. Then I chrooted into /mnt/oldroot, su - me and ecryptfs-mount-private. Asked for the passphrase I put it in and got:

Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]
Info: Check the system log for more information from libecryptfs
ERROR: Your passphrase is incorrect

ecryptfs-unwrap-passphrase gives me the exact same passphrase I used, though.

Community
  • 1
rausch
  • 896

4 Answers4

38

I strongly recommend that you use the ecryptfs-recover-private utility in these cases.

A full explanation of how to use it is available here.

Dustin Kirkland
  • 14,608
  • 9
    Just an hint to myself because it's the n-th time I have to run this command and every time I have to reverse engineer how it works: the correct syntax to skip the whole-tree file search and crack-open an old home dir, is: sudo ecryptfs-recover-private --rw .ecryptfs/<YOUR_USER>/.Private. No need to exhume the 32 bytes long passphrase, just a few attempts to guess the password of that old pc. – Avio Aug 14 '16 at 18:02
  • Having some similar yet different issues on a new post (https://askubuntu.com/questions/1035424/ubuntu-18-04-mount-encrypted-disk) , do you think you could share your expertise on this? Thanks! – Matifou May 12 '18 at 23:00
  • 3
    Sometimes this gives Error: Unwrapping passphrase and inserting into the user session keyring failed [-5] even though the passphrase is correct. As per https://unix.stackexchange.com/questions/285541/mount-no-such-file-or-directory-with-encrypted-recovery/395391#comment878481_395391, it's helpful to run sudo ecryptfs-manager, then press 4 (exit), then run ecryptfs-recover-private again. – Turion Apr 03 '19 at 11:05
  • I did exactly this, and I first thought it did work, as I got "INFO: Success! Private data mounted at [/tmp/ecryptfs.xxx]." However ecryptfs-recover-private seems to mount my current home dir also under /tmp/ecryptfs.xxx, but not the one I from my backup I passed to the script. Any idea? – Peter T. Jun 30 '21 at 13:54
  • Ah, found it: there is a symlink from backup-dir/home/user/.Private to my current home ... – Peter T. Jun 30 '21 at 13:58
18

I finally managed to mount my encrypted home by first adding the passphrase via

sudo ecryptfs-add-passphrase --fnek

Which gets me the following information:

Inserted auth tok with sig [aaaaaaaaaaaaaaaa] into the user session keyring
Inserted auth tok with sig [bbbbbbbbbbbbbbbb] into the user session keyring

There, I remember bbbbbbbbbbbbbbbb and proceed with mounting the associated .Private directory:

sudo mount -t ecryptfs /mnt/oldhome/.ecryptfs/me/.Private /mnt/oldme

A lot of questions pop up, which I all answer with their defaults except for

Enable filename encryption (y/n) [n]: y

and

Filename Encryption Key (FNEK) Signature [aaaaaaaaaaaaaaaa]: bbbbbbbbbbbbbbbb

With bbbbbbbbbbbbbbbb, of course, being the signature I previously remembered. Easy, huh?

rausch
  • 896
  • 3
    Hi @rausch ! Just a clarification question: when you run the first command (ecryptfs-add-passphrase), do you indicate the passphrase from the old or new home/system? And by passprhase you mean the code obtained by ecryptfs-unwrap-passphrase or just login? Thanks!! – Matifou Jul 10 '16 at 22:05
  • a) Old system, and a) the code. Worked like a charm! – Piskvor left the building Dec 23 '16 at 17:28
  • @rausch I noticed in next to my wrapped-passphrase file was a Private.sig file that matched up wit the sig's that you get from ecryptfs-add-passphrase --fnek. So you can use that to make sure you are typing the right everything. Thanks! – Eric Twilegar Feb 09 '17 at 02:52
3

Try:

sudo ecryptfs-recover-private /media/<username>/<disk-guid>/home/.ecryptfs/<username>/.Private

output if you know the login passphrase:

INFO: Found [/media/<username>/<disk.guid>/home/.ecryptfs/<username>/.Private].
Try to recover this directory? [Y/n]: 
INFO: Found your wrapped-passphrase
Do you know your LOGIN passphrase? [Y/n] 
INFO: Enter your LOGIN passphrase...
Passphrase: 
Inserted auth tok with sig [c67c3e3ace421e76] into the user session keyring
INFO: Success!  Private data mounted at [/tmp/ecryptfs.xblDkqNZ].

Last line shows where the decrypted data is mounted

Credits to Santiago G. Marín on the comments section from this post

Italo Muñoz
  • 31
1

I had the same error ERROR: Failed to mount private data at [/tmp/ecryptfs....] after I renamed the previous (original) POSIX username to old_user and then created a new user with the original (previous username's) login.

To be able to mount the encrypted home directory from the old_user, I had to remake the symbolik links for .encryptfs and .Private in its folder (as they had poinded to /home/original_name/).

After that, the following command mounted the old home without any problem.

/usr/bin/ecryptfs-recover-private /home/old_user/.Private

If the above fails because of the key issue (see dmesg or syslog), e.g.

Could not find key with description: [XXX]
process_request_key_err: No key Could not find valid key in user session keyring for sig specified in mount option: [XXX]

then, try adding the passphrase manually: Option 1 in /usr/bin/ecryptfs-manager (it may show you that the key is already there, it's OK.) and then execute ecryptfs-recover-private /home/old_user/.Private once again.

Yaroslav Fedorina
  • 86
  • 3