1

I tried to delete ecryptfs from my computer so I wrote in the terminal

$ PRIVATE=`cat ~/.ecryptfs/Private.mnt 2>/dev/null || echo $HOME/Private`
$ ecryptfs-umount-private

and now my home folder seems to be empty.

How can I restore my data? I had there important data. Do I need to mount my home folder back? If so, how can I do it? I tried rebooting, which didn't help.

And how do I revert from using an encrypted home folder without losing my data? I don't want to use ecryptfs anymore, and all my current data should be available in plain on my hard drive.

EDIT: The result for these commands:

$ ls /home/.ecryptfs/my_user/.Private | head
ECRYPTFS_FNEK_ENCRYPTED.FWbOl2isOC9ScESAHyXJKgdV6pdWpf-xTJML0HpAyj4B47gvi8NfhNPzQE--
ECRYPTFS_FNEK_ENCRYPTED.FWbOl2isOC9ScESAHyXJKgdV6pdWpf-xTJML1NoC3E4VG6lgU7ry20gLR---
ECRYPTFS_FNEK_ENCRYPTED.FWbOl2isOC9ScESAHyXJKgdV6pdWpf-xTJML2EdR95BqA7AdiKe9d71xA---
ECRYPTFS_FNEK_ENCRYPTED.FWbOl2isOC9ScESAHyXJKgdV6pdWpf-xTJML4kKEf3amHWtlShyHiveiq---
ECRYPTFS_FNEK_ENCRYPTED.FWbOl2isOC9ScESAHyXJKgdV6pdWpf-xTJML4mnnK0ObQGfJgsbnilThfk--
ECRYPTFS_FNEK_ENCRYPTED.FWbOl2isOC9ScESAHyXJKgdV6pdWpf-xTJML-4VDqP7q4LxuMItSFeBdrE--
ECRYPTFS_FNEK_ENCRYPTED.FWbOl2isOC9ScESAHyXJKgdV6pdWpf-xTJML4xJnWwKHLnpPRVRK4yx7UU--
ECRYPTFS_FNEK_ENCRYPTED.FWbOl2isOC9ScESAHyXJKgdV6pdWpf-xTJML6E2-IFSM7hF5gjV26PgpJk--
ECRYPTFS_FNEK_ENCRYPTED.FWbOl2isOC9ScESAHyXJKgdV6pdWpf-xTJML77wgt4UK7NPKBNKpu.BJzE--
ECRYPTFS_FNEK_ENCRYPTED.FWbOl2isOC9ScESAHyXJKgdV6pdWpf-xTJML8a2bimSR65c9rtSsoDQWlU--

$ ls /home/.ecryptfs/my_user/.ecryptfs
auto-mount  auto-umount  Private.mnt  Private.sig  wrapped-passphrase

$ cat /home/.ecryptfs/my_user/.ecryptfs/Private.mnt
/home/my_user
Malte Skoruppa
  • 13,196
  • 5
  • 57
  • 65
Danis Fischer
  • 227
  • 5
  • 16

1 Answers1

2

You can recover your encrypted data by issuing the following command:

sudo ecryptfs-recover-private

You will see an output such as this:

INFO: Searching for encrypted private directories (this might take a while)...
INFO: Found [/home/.ecryptfs/USERNAME/.Private].
Try to recover this directory? [Y/n]:

Hit enter, and follow the steps...

INFO: Found your wrapped-passphrase
Do you know your LOGIN passphrase? [Y/n] Y
INFO: Enter your LOGIN passphrase...
Inserted auth tok with sig [xxxxxxxxxxxxxxxx] into the user session keyring
INFO: Success! Private data mounted at [/tmp/ecryptfs.m6OUhFlJ]

You can now access all your data in the folder /tmp/ecryptfs.m6OUhFlJ (or similar, the text after the dot is random). You will need to copy all of that where you want it (e.g., in your home folder), using a file browser or by using something like:

rsync -Cav /tmp/ecryptfs.m6OUhFlJ/ ~

Note that you will need at least as much free space as the size of the encrypted data for this. Otherwise you will have to use an external hard disk or some such to copy your unencrypted data to.

Finally, you can remove the ecryptfs utilities using either the Software Center or a command such as

sudo apt-get remove ecryptfs-utils

...and now, to free space, and only once you've made sure that all your unencrypted data has been copied somewhere safe, you can remove the encrypted data. Careful! This will irrevocably delete ALL your encrypted data! Use with caution!

sudo rm -r /home/.ecryptfs/USERNAME
Malte Skoruppa
  • 13,196
  • 5
  • 57
  • 65