Welcome to bytebang » The blog about all and nothing » Recover files from an encrypted home partition

Recover files from an encrypted home partition

Nov 07 2017

The Problem

Assume that your computer does not want to start any more (e.g. because of a kernel panic during boot or a corrupted file system), and you want to make a last backup of your /home directory ... well - this us usually not a big deal if your home directory is not encrypted.

BUT: If it is encrypted, then things tend to get complicated, because you can not easily access the files within the encrypted directory.

Here is my approach how to deal with such things.

The Solution

This approach works only if you know the decryption key which was used to encrypt the home directory. If you do not know it any more then you are most probably lost.

Fortunately there is a cool tool which is able to mount your encrypted home partition in one single step: ecryptfs

So the steps to recover your data should be the following:

  1. Boot with a live CD (in my case: Ubuntu mate 17.04d / i386)
  2. Mount a harddisk which is big enough to store your files (in my case: /media/ubuntu-mate/backup)
  3. Mount the encrypted home drive (read-only)
  4. Copy all the files to the backup disk

And here is what it looks like in the terminal:

sudo ecryptfs-recover-private /media/ubuntu-mate/1c8d8542-2656-4608-a7ce-8106459044cd/home/.ecryptfs/USER/.Private/
INFO: Found [/media/ubuntu-mate/1c8d8542-2656-4608-b7ce-8106459044cd/home/.ecryptfs/USER/.Private/].
Try to recover this directory? [Y/n]: Y
INFO: Found your wrapped-passphrase
Do you know your LOGIN passphrase? [Y/n] Y
Enter your LOGIN passphrase:
INFO: Success!  Private data mounted read-only at [/tmp/ecryptfs.AkoFDtJw].
sudo rsync -av --progress /tmp/ecryptfs.AkoFDtJw/ /media/ubuntu-mate/Backup/

The first part shows the usage of ecryptfs, and the second one utilizes rsync to copy the (now) encrypted data to the backup disk.

Get Social

(c) 2020, by bytebang e.U. - Impressum - Datenschutz / Nutzungsbedingungen