I recently found myself needing to restore data from a backup of an ecryptfs-encrypted Ubuntu home partition. This didn’t go as smoothly as when testing backup restoration (in part because ecryptfs has since fallen out of favor, replaced by LUKS), I thought I’d document the pertinent steps here.
I used a live Ubuntu system from a USB thumb drive, which I booted from to perform the following operations. Once within the live system, I first had to install the ecryptfs tools, as they’re no longer part of the standard distribution, and in fact aren’t even part of the standard software accessible by apt by default.
We start by installing ecryptfs (make sure you’re connected to the web!). From a terminal, execute
sudo add-apt-repository universe
sudo apt-get update
sudo apt-get install -y ecryptfs-utilsNext make sure your USB drive (or whatever you’re accessing) is mounted, and navigate to the .ecryptfs folder it contains. Typically, this is a sibling of the encrypted Private folder. Note that the .ecryptfs node in a user’s home folder could be a link to a different location. If you can’t `cd` into it, use ls -al to see what it was pointing to on the original system and navigate there manually: often the /home/john/.ecryptfs will actually be a link to /home/.ecryptfs/john/.ecryptfs which was broken when performing the backup.
sudo su
cd /media/ubuntu/my_backup_location/.ecryptfs
ecryptfs-unwrap-passphrase wrapped-passphraseThis will prompt you for the login password of the user whose home directory you’re trying to decrypt. After entering it, you’ll see a 32-character passphrase in the terminal.
Many of the following steps are executed as the superuser when they could also be executed as a normal user. However the recovery command must be executed as root, and the steps to add the passphrase to the keyring must also be executed as root or the passphrase won’t be found when the time comes…
Open a new terminal (this is for convenience, you could also just continue in this one) and execute:
sudo ecryptfs-managerAnd select the first option (Add passphrase key to keyring). Follow the instructions, and you should see
eCryptfs key management menu
-------------------------------
1. Add passphrase key to keyring
2. Add public key to keyring
3. Generate new public/private keypair
4. Exit
Make selection: 1
Mount-wide passphrase:
Confirm passphrase:
Using the default salt value
Added key to keyring with signature [ed12d26eafadb530].You can copy/paste by selecting the passphrase then middle-clicking (or clicking with both mouse buttons simultaneously if you have no middle button) to paste it: note that the terminal will not provide any feedback that you’ve entered text. Just trust in the system ;-)
You may also be told “Passphrase mismatch. Aborting mount” (e.g. if you copy/paste twice or have a typo): repeat the steps until you see one of the success messages above.
(It appears that some users, e.g. on Debian had to execute sudo keyctl link @a @u also.)
Finally, navigate to the encrypted backup again and recover it:
cd /media/ubuntu/my_backup_location
sudo ecryptfs-recover-private .PrivateFollow the prompts, and you should be greeted by the following message:
INFO: Found [.Private].
Try to recover this directory? [Y/n]:
INFO: Found your wrapped-passphrase
Do you know your LOGIN passphrase? [Y/n]
INFO: Enter your LOGIN passphrase...
Passphrase:
Inserted auth tok with sig [c67c3e3ace421e76] into the user session keyring
INFO: Success! Private data mounted at [/tmp/ecryptfs.abcd123].To access your files graphically, open a new terminal (once again for convenience, you could also continue in the same one) and
sudo nautilus /tmp/ecryptfs.abcd123You can stop reading here, as I just want to chronicle a few missteps and error messages so that poor souls trying to access their encrypted data after a hardware failure can find this when searching for various error messages.
Normally, the recovery process would consist of simply executing ecryptfs-recover-private and following the prompts. This did indeed work flawlessly when testing my backup system. Unfortunately, when things went sideways it didn’t go as planned. The first problem is that the command may not find your encrypted data when scanning the system for it. Then, even if you point it in the right direction (by providing the argument as we did above), it will typically be unable to mount the decrypted data due to permissions snafu. The error message you’ll see will be something like:
INFO: Found [.Private].
Try to recover this directory? [Y/n]:
INFO: Found your wrapped-passphrase
Do you know your LOGIN passphrase? [Y/n]
INFO: Enter your LOGIN passphrase...
Passphrase:
Inserted auth tok with sig [cdcad9e070a753cf] into the user session keyring
mount: /tmp/ecryptfs.a4m7KhsL: mount(2) system call failed: No such file or directory.
ERROR: Failed to mount private data at [/tmp/ecryptfs.a4m7KhsL].It also happened that I was able to successfully mount the decrypted data, but all of the filenames were still encrypted. This was resolved by running
sudo ecrypts-add-passphrase --fnekand entering the passphrase we obtained above (the 32 char string). You should see output similar to
Inserted auth tok with sig [aaaaaaaaaaaaaaaa] into the user session keyring
Inserted auth tok with sig [bbbbbbbbbbbbbbbb] into the user session keyringRepeating the sudo ecryptfs-recover-private .Private step should then mount the files with decrypted filenames.