How can I rescue my encrypted home directory from a corrupted boot laptop?

[Tucansm]

.
How can I rescue my encrypted home directory from a corrupted boot laptop that is running Cinnamon?

Hi all.

How can I rescue or even just access my encrypted home directory, which is on a laptop running Cinnamon with a corrupted boot? I have been trying to do this by booting the laptop with a Cinnamon live flash drive, and I can see, but can't access, my original encrypted home directory.

I'm in trouble and I really need some help. I’m not an experienced Linux guy, but I can follow step by step instructions.

My Cinnamon system is encrypted and requires a password to boot, and a password to login. I manually deleted the wrong files to clear my boot folder which was full. I have done this before but this time I deleted something, I have no idea what, and I made my system unbootable.

When I tried to boot I got a message similar to “error: file `/vmlinuz-5.4.0-113-generic' not found”

Then I made things worse (because apparently I’m an idiot) by running a program called “Boot Repair Disk” while accessing the system using a current download of Cinnamon booted from a live flash drive.

Now when I start my laptop I see GNU GRUB version 2.04 with an option to boot Ubuntu instead of Linux Mint, and selecting that brings up the command line: (initramfs) _

When I boot from the Cinnamon live flash drive, I can see my encrypted home directory but I can’t access it.

Clicking the Computer icon on the Desktop shows my encrypted directory listed as “Toshiba MQ04ABF100 999 GB Encrypted”. Clicking that asks for my password, which is accepted. This produces a 2nd icon listed as “998 GB Volume”.

998 GB Volume ==== produces a typical file list. Clicking the “home” folder produces a folder with the name of my original home directory marked with an ‘x’. Clicking that produces 2 files,
Access-Your-Private-Data.desktop (marked with an arrow)
README.txt

README.txt ==== says “This directory has been unmounted to protect your data. From the graphical desktop, click on: “Access Your Private Data” or From the command line, run: ecryptfs-mount-private”

Access-Your-Private-Data.desktop ==== right clicked, selected “Follow link to original file” links to,
admin:///usr/share/ecryptfs-utils

admin:///usr/share/ecryptfs-utils ==== opened directory as root (with no password prompt), shows 4 files,
ecryptfs-mount-private.desktop
ecryptfs-mount-private.txt
ecryptfs-setup-private.desktop
ecryptfs-record-passphrase

ecryptfs-mount-private.desktop ==== seems to do nothing

ecryptfs-mount-private.txt ==== says “This directory has been unmounted to protect your data. From the graphical desktop, click on: “Access Your Private Data” or From the command line, run: ecryptfs-mount-private” [see below for this]

ecryptfs-setup-private.desktop ==== opens a terminal with “Enter your login passphrase [root]:”
Entering my login password (also tried my encryption password), produces “ERROR: Your login passphrase is incorrect”

ecryptfs-record-passphrase ==== can open as a txt or run as an executable, open as txt produces the following instructions,

==== Start ====
Name: Record your encryption passphrase
Priority: High
OnlyAdminUsers: False
DisplayIf: test -e $HOME/.ecryptfs/wrapped-passphrase -a ! -e $HOME/.ecryptfs/.wrapped-passphrase.recorded
Terminal: True
GettextDomain: ecryptfs-utils
Command: "sh -c 'ecryptfs-unwrap-passphrase $HOME/.ecryptfs/wrapped-passphrase 2>/dev/null && echo [Enter] && head -n1 && touch $HOME/.ecryptfs/.wrapped-passphrase.recorded '"

Description:
To encrypt your home directory or "Private" folder, a strong passphrase has been automatically generated. Usually your directory is unlocked with your user password, but if you ever need to manually recover this directory, you will need this passphrase. Please print or write it down and store it in a safe location.

If you click "Run this action now", enter your login password at the "Passphrase" prompt and you can display your randomly generated passphrase. Otherwise, you will need to run "ecryptfs-unwrap-passphrase" from the command line to retrieve and record your generated passphrase.
==== End ====

"Run this action now" ==== I don’t see any graphical menu option for this, but clicking ecryptfs-setup-private.desktop as seen above seems to produce this function and gives an error message

ecryptfs-unwrap-passphrase ==== from the command line I get the following results

==== Start ====
root@mint:/usr/share/ecryptfs-utils# ecryptfs-unwrap-passphrase
stat: No such file or directory
Usage:

ecryptfs-unwrap-passphrase [file]
or
printf "%s" "wrapping passphrase" | ecryptfs-unwrap-passphrase [file] -
==== End ====

Followed instruction above, entered command, entered my login password at prompt, got this result

==== Start ====
root@mint:/usr/share/ecryptfs-utils# ecryptfs-unwrap-passphrase ecryptfs-record-passphrase
Passphrase:
Error: Unwrapping passphrase failed [-22]
Info: Check the system log for more information from libecryptfs
root@mint:/usr/share/ecryptfs-utils#
==== End ====

Checked the system log as instructed above, got this result

cat /var/log/syslog ==== “mint ecryptfs-unwrap-passphrase: Failed to detect wrapped passphrase version: Invalid argument”

This is as far as I have gotten so far. I was hoping someone could help me.

My question is what is the best way to fix this problem without losing my encrypted files? Can I fix the boot process without losing my encrypted files? Can I access and remove my encrypted files and then do a fresh Cinnamon load? Whatever is easiest and safest is best.

Any experienced help would be greatly appreciated. Thank you very much.
.

[SMG]

How can I rescue my encrypted home directory from a corrupted boot laptop that is running Cinnamon?

Welcome to the forum, Tucansm.

See if this topic helps you HOWTO: Recover files from encrypted ecryptfs home directory.

Do you have any Timeshift snapshots? If so, you can use Timeshift on the live session to restore to a snapshot.

[Tucansm]

Thanks for the reply SMG.

I am not familiar with Timeshift. I will do some reading and see if I can utilize it. I will also check your suggested link, thank you.

I am not very Linux literate (I'm sure it's obvious). I can get around the system but it takes me a while. Mint has been really smooth for me for 2 years or more (current issue being my fault really), and I usually just use it like a windows machine. It's been many hours to get as far as I posted. Actually got nauseous at one point when I thought I completely crashed the system.

I will read up on Timeshift and your link, and post any follow up. Thanks very much again.

[pbear]

Sorry, but I have to say it. Surely you know data files should be backed up. Had you done that, this problem would be small potatoes.

The tutorial to which SMG has referred you is good, but complicated. Encryption is a complicated thing. Take your time.

[Tucansm]

I hear you on the backups pbear. I have a long sad story about how my normal backup routine failed, but that's for another day.

It looks like I do have Timeshift active on my system. Not sure if it was setup by default, but it's populated.

I have snapshots as recently as 2022-06-22, which is probably when I deleted my boot files and started this mess. There is a lot of stuff here, I don't want to just click on things without knowing which to use. I need to take some time to understand what I'm looking at before I use it.

SMG, if you want me to post anything to help narrow down what I should be doing, please let me know. And thanks for suggesting Timeshift, it looks like it could work.

[rene]

Just a note: SMG is in a US timezone so you may need to wait around a bit for her. I personally don't use Timeshift so shan't be advising on that -- but certainly that's the primary thing to try before going all out on recovery. Hope someone familiar with Timeshift and in a compatible timezone is available to advise.

[SMG]

I have snapshots as recently as 2022-06-22, which is probably when I deleted my boot files and started this mess. There is a lot of stuff here, I don't want to just click on things without knowing which to use. I need to take some time to understand what I'm looking at before I use it.

If you do not recall setting it up, then Timeshift is probably using the default settings. The default settings are a backup of system files. That means when you restore to a snapshot, any personal files created since then are not touched.

If you restore to the snapshot from 2022-06-22 and it does not work, you can always make another attempt and restore to an even earlier snapshot.

Here is a short (<5 minute) video explaining Timeshift How to Backup and Restore Your Linux Installation – Timeshift – RSYNC ⁄ BTRFS – Arch ⁄ Ubuntu

[Tucansm]

Just a note: SMG is in a US timezone so you may need to wait around a bit for her. I personally don't use Timeshift so shan't be advising on that -- but certainly that's the primary thing to try before going all out on recovery. Hope someone familiar with Timeshift and in a compatible timezone is available to advise.

Thanks for letting me know rene, I appreciate it. I didn’t expect anyone to be up, actually forgot about all the other time zones too.

I have snapshots as recently as 2022-06-22, which is probably when I deleted my boot files and started this mess. There is a lot of stuff here, I don't want to just click on things without knowing which to use. I need to take some time to understand what I'm looking at before I use it.

If you do not recall setting it up, then Timeshift is probably using the default settings. The default settings are a backup of system files. That means when you restore to a snapshot, any personal files created since then are not touched.

If you restore to the snapshot from 2022-06-22 and it does not work, you can always make another attempt and restore to an even earlier snapshot.

Here is a short (<5 minute) video explaining Timeshift How to Backup and Restore Your Linux Installation – Timeshift – RSYNC ⁄ BTRFS – Arch ⁄ Ubuntu

Thank you for the follow up SMG.

I read up on Timeshift and watched some videos. It looked straight forward enough to give it a try, but it did not fix the problem unfortunately. I have 5 Timeshift snapshots to restore to, I ran them all and none fixed the boot issue. I also ran one a second time after selecting the fix initramfs option in the Timeshift boot tab. But other than producing some errors in the Timeshift report, which none of the other runs did, the end result was the same.

Timeshift seems to run ok and restores a lot of stuff including boot files, but it doesn’t change the outcome when I restart the system, it still loads to the command line: (initramfs) _

It’s notable that my Timeshift snapshots are located in my encrypted directory. They don’t show up in the Timeshift wizard until I unlock the directory with my password. But this doesn’t seem to affect the Timeshift process once they show up in the Timeshift snapshot list. Though I will add that I almost needed a fresh pair of shorts when my first attempt restarted with all my snapshots disappearing and me thinking I wiped them off the system.

I am sure the major damage here was done by running the “Boot Repair Disk” program. I am also sure that Linux Mint is on the system, it just can’t boot through initramfs. It would not surprise me if a initramfs expert could solve this problem fairly easily.

I think I need to sleep for a bit. I don’t know if it’s the not sleeping for 2 days, the not eating anything, the drinking way too much coffee, or possibly the listening to WJSN Super Yuppers at max volume, but I’m starting to feel somewhat reckless about this data recovery. Probably not the best scenario for success.

The stuff on this drive is very important, so I'm going to take a break and hit it fresh later today or tonight. I can also post more details of what I see in the boot menu in case it may be helpful.

Short of any new developments or an initramfs expert, I'm guessing my focus will need to shift to your original link on how to recover files from an encrypted ecryptfs home directory.

Thanks very much again for all the help.

[gittiest personITW]

If you haven't got any backups, maybe you should image the drive first - easiest would be Foxclone which you'd have to put on a USB or DVD and boot into it.
https://www.foxclone.com/

This way, even if something goes wrong, you'll have one backup, allbeit encrypted.

[SMG]

Timeshift seems to run ok and restores a lot of stuff including boot files, but it doesn’t change the outcome when I restart the system, it still loads to the command line: (initramfs) _

I will take another look at what you posted a bit later today to see if I can come up with other ideas.

It’s notable that my Timeshift snapshots are located in my encrypted directory. They don’t show up in the Timeshift wizard until I unlock the directory with my password.

Timeshift does not save snapshots to the home directory if one uses the default settings. Its default saves them to the root directory.

There is a difference between having just your home directory encrypted and having your entire drive encrypted. I understood your initial post to indicate just /home was encrypted. What exactly do you have encrypted?

(Someone posted on the forum who had their home directory encrypted inside of their encrypted drive. That is not the norm. Usually, either the entire drive is encrypted or just home is encrypted.)

[rene]

[ ... ] when I restart the system, it still loads to the command line: (initramfs)

Didn't earlier read closely but isn't it just telling you that you need to manually check the root filesystem? If so it would also tell you what device said root filesystem is on and/or you might be told after on that (initramfs) prompt saying exit, <enter> (which would if this were the issue loop you back into the initramfs). If this is it and it tells you that for example /dev/sda1 needs to be checked, use from still that (initramfs) prompt

Code: Select all

fsck -fy /dev/sda1

and when/if it finishes, again exit to continue the boot.

[EDIT] ... and now also reading your OP more closely it appears you use both full-disk and home-directory encryption. You shouldn't have, but seeing as how you're able to unlock the full-disk part it's not necessarily a large complication. What it does mean however is that your root filesystem will not reside on a physical partition-device such as the mentioned /dev/sda1 but on, likely, /dev/mapper/mint--vg-root. I.e., you'd use

Code: Select all

fsck -fy /dev/mapper/mint--vg-root

from that (initramfs) prompt.

I by the way am also almost off; if it's not as simple as above, I'll supposedly be able to guide you through unlocking the home-directory later if no one beats me to it.

[pbear]

If fsck doesn't solve the problem, we should be able to walk you through reinstalling Grub manually. That's easy with an unencrypted system. Doubtless possible for your case, but I've not done it. Maybe someone else knows how. Meanwhile, I'll give it a trial in a virtual machine.

And I hear you about only learning data file backup has failed after the fact. Been there, done that. Now I keep several, on separate devices.

[SMG]

My Cinnamon system is encrypted and requires a password to boot, and a password to login. I manually deleted the wrong files to clear my boot folder which was full. I have done this before but this time I deleted something, I have no idea what, and I made my system unbootable.

The default Linux Mint install for an encrypted drive does have a rather small boot partition (which is not encrypted). However, rather than manually "cleaning" it, we normally recommend using Update Manager to selectively remove kernels.

It sounds you have full disk encryption and not just the home folder encrypted. That would explain why Timeshift was in an encrypted section of your drive. However, as I mentioned, others have done both (full disk encryption and home encrypted within the full-disk encrypion) which just makes the situation more complicated. What do you recall doing when you first installed? Did you just do full-disk encryption or did you also encrypt /home in addition to the full-disk encryption?

When I tried to boot I got a message similar to “error: file `/vmlinuz-5.4.0-113-generic' not found"

Then I made things worse (because apparently I’m an idiot) by running a program called “Boot Repair Disk” while accessing the system using a current download of Cinnamon booted from a live flash drive.

That sounds like what the person in this older topic wanted to do [Solved] - Error file vmlinuz not found - (Pastebin Boot Info Script). That person had deleted all kernels which is a problem that boot repair can not fix. It is possible you did the same thing.

I would have thought a Timeshift snapshot would have fixed a missing kernels issue, but maybe something else happened. What version of Linux Mint are you running, LM19 or LM20?

Please boot to the live session using the install usb and provide the output of

Code: Select all

inxi -Fxxxrz

That will give us information about your hardware and whether you are booting UEFI or Legacy-BIOS.

[Tucansm]

.
Thank you for all the feedback, sorry for my delay, I had some things that needed my attention. Also needed to get another system up and running until this gets resolved.

and now also reading your OP more closely it appears you use both full-disk and home-directory encryption. You shouldn't have, but seeing as how you're able to unlock the full-disk part it's not necessarily a large complication. What it does mean however is that your root filesystem will not reside on a physical partition-device such as the mentioned /dev/sda1 but on, likely, /dev/mapper/mint--vg-root. I.e., you'd use

Code: Select all

fsck -fy /dev/mapper/mint--vg-root

from that (initramfs) prompt.

[ 0.419184] ACPI BIOS Error (bug): Could not resolve symbol [\_SB.PCIO.DGPV], AE_NOT_FOUND (20190816/psargs-330)
[ 0.419217] ACPI Error: Aborting method \_SB.PCIO.RPOS.PCRP._ON due to previo us error (AE_NOT_FOUND) (20190816/psparse-529)

BusyBox v1.30.1 (Ubuntu 1:1.30.1-4ubuntu6.4) built-in shell (ash)
Enter 'help' for a list of built-in commands.

(initramfs) exit
Gave up waiting for root file system device. Common problems:
- Boot args (cat /proc/cmdline)
- Check rootdelay= (did the system wait long enough?)
- Missing modules (cat /proc/modules; ls /dev)
ALERT! /dev/mapper/vgmint-root does not exist. Dropping to a shell!

BusyBox v1.30.1 (Ubuntu 1:1.30.1-4ubuntu6.4) built-in shell (ash)
Enter 'help' for a list of built-in commands.

(initramfs)

If fsck doesn't solve the problem, we should be able to walk you through reinstalling Grub manually.

Thank you, that would be very helpful if it can be done.

Did you just do full-disk encryption or did you also encrypt /home in addition to the full-disk encryption?

I did both, full disk and also home folder. So before I messed it up, password at startup, then it boots, then 2nd password to login.

Please boot to the live session using the install usb and provide the output of

Code: Select all

inxi -Fxxxrz

That will give us information about your hardware and whether you are booting UEFI or Legacy-BIOS.

To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

Code: Select all

mint@mint:~$ inxi -Fxxxrz
System:
  Kernel: 5.4.0-91-generic x86_64 bits: 64 compiler: gcc v: 9.3.0
  Desktop: Cinnamon 5.2.7 wm: muffin 5.2.0 dm: LightDM 1.30.0
  Distro: Linux Mint 20.3 Una base: Ubuntu 20.04 focal
Machine:
  Type: Laptop System: HP product: HP Laptop 15-dw2xxx
  v: Type1ProductConfigId serial: <filter> Chassis: type: 10
  serial: <filter>
  Mobo: HP model: 85F3 v: 40.27 serial: <filter> UEFI: Insyde v: F.31
  date: 07/31/2020
Battery:
  ID-1: BAT1 charge: 38.9 Wh condition: 38.9/41.0 Wh (95%) volts: 12.9/11.3
  model: COMPAL PABAS0241231 type: Li-ion serial: <filter> status: Full
CPU:
  Topology: Quad Core model: Intel Core i5-1035G1 bits: 64 type: MT MCP
  arch: Ice Lake rev: 5 L2 cache: 6144 KiB
  flags: avx avx2 lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx
  bogomips: 19046
  Speed: 1213 MHz min/max: 400/3600 MHz Core speeds (MHz): 1: 1101 2: 1101
  3: 1100 4: 1101 5: 1101 6: 1101 7: 1103 8: 1101
Graphics:
  Device-1: Intel vendor: Hewlett-Packard driver: i915 v: kernel
  bus ID: 00:02.0 chip ID: 8086:8a56
  Display: x11 server: X.Org 1.20.11 driver: modesetting
  unloaded: fbdev,vesa resolution: 1366x768~60Hz
  OpenGL: renderer: Mesa Intel UHD Graphics (ICL GT1) v: 4.6 Mesa 21.0.3
  direct render: Yes
Audio:
  Device-1: Intel Smart Sound Audio vendor: Hewlett-Packard
  driver: snd_hda_intel v: kernel bus ID: 00:1f.3 chip ID: 8086:34c8
  Sound Server: ALSA v: k5.4.0-91-generic
Network:
  Device-1: Realtek RTL8111/8168/8411 PCI Express Gigabit Ethernet
  vendor: Hewlett-Packard driver: r8169 v: kernel port: 4000 bus ID: 01:00.0
  chip ID: 10ec:8168
  IF: eno1 state: down mac: <filter>
  Device-2: Realtek RTL8822CE 802.11ac PCIe Wireless Network Adapter
  vendor: Hewlett-Packard driver: rtw_pci v: N/A port: 3000 bus ID: 02:00.0
  chip ID: 10ec:c822
  IF: wlo1 state: up mac: <filter>
Drives:
  Local Storage: total: 1.03 TiB used: 141.16 GiB (13.4%)
  ID-1: /dev/sda vendor: Toshiba model: MQ04ABF100 size: 931.51 GiB
  speed: 6.0 Gb/s rotation: 5400 rpm serial: <filter> rev: 7C temp: 32 C
  scheme: GPT
  ID-2: /dev/sdb type: USB model: Mass Storage Device size: 119.08 GiB
  serial: <filter> rev: 1.00 scheme: MBR
RAID:
  Hardware-1: Intel 82801 Mobile SATA Controller [RAID mode] driver: ahci
  v: 3.0 port: 5060 bus ID: 00:17.0 chip ID: 8086.282a rev: 30
Partition:
  ID-1: / size: 7.66 GiB used: 19.2 MiB (0.2%) fs: overlay source: ERR-102
  ID-2: /var/log size: 114.65 GiB used: 69.2 MiB (0.1%) fs: ext4
  dev: /dev/sdb3
Sensors:
  System Temperatures: cpu: 27.8 C mobo: 10.0 C
  Fan Speeds (RPM): N/A
Repos:
  Active apt repos in: /etc/apt/sources.list
  1: deb cdrom:[Linux Mint 20.3 _Una_ - Release amd64 20220104]/ focal contrib main
  Active apt repos in: /etc/apt/sources.list.d/official-package-repositories.list
  1: deb http://packages.linuxmint.com una main upstream import backport #id:linuxmint_main
  2: deb http://archive.ubuntu.com/ubuntu focal main restricted universe multiverse
  3: deb http://archive.ubuntu.com/ubuntu focal-updates main restricted universe multiverse
  4: deb http://archive.ubuntu.com/ubuntu focal-backports main restricted universe multiverse
  5: deb http://security.ubuntu.com/ubuntu/ focal-security main restricted universe multiverse
  6: deb http://archive.canonical.com/ubuntu/ focal partner
Info:
  Processes: 262 Uptime: 4m Memory: 15.32 GiB used: 819.1 MiB (5.2%)
  Init: systemd v: 245 runlevel: 5 Compilers: gcc: 9.3.0 alt: 9 Shell: bash
  v: 5.0.17 running in: gnome-terminal inxi: 3.0.38
mint@mint:~$

Thanks very much again for all the help!

[Tucansm]

Code: Select all

fsck -fy /dev/mapper/mint--vg-root

from that (initramfs) prompt.

Sorry, forgot to do this before.

BusyBox v1.30.1 (Ubuntu 1:1.30.1-4ubuntu6.4) built-in shell (ash)
Enter 'help' for a list of built-in commands.

(initramfs) exit
Gave up waiting for root file system device. Common problems:
- Boot args (cat /proc/cmdline)
- Check rootdelay= (did the system wait long enough?)
- Missing modules (cat /proc/modules; ls /dev)
ALERT! /dev/mapper/vgmint-root does not exist. Dropping to a shell!

BusyBox v1.30.1 (Ubuntu 1:1.30.1-4ubuntu6.4) built-in shell (ash)
Enter 'help' for a list of built-in commands.

(initramfs) fsck -fy /dev/mapper/vgmint-root
fsck from util-linux 2.34
fsck: error 2 (No such file or directory) while executing fsck.ext2 for /dev/mapper/vgmint-root
(initramfs)

[rene]

ALERT! /dev/mapper/vgmint-root does not exist. Dropping to a shell!

Why would you type /dev/mapper/vgmint-root when I said to use /dev/mapper/mint--vg-root? Computers do as you say, not as you intend.

This may be too confused/ing for me to furthermore assist (without getting perma-banned from the forum due to extreme rudeness) so if that typo-thing doesn't yet help I'll step out...

[Tucansm]

ALERT! /dev/mapper/vgmint-root does not exist. Dropping to a shell!

Why would you type /dev/mapper/vgmint-root when I said to use /dev/mapper/mint--vg-root? Computers do as you say, not as you intend.

This may be too confused/ing for me to furthermore assist (without getting perma-banned from the forum due to extreme rudeness) so if that typo-thing doesn't yet help I'll step out...

My mistake, always best to assume I'm an idiot, let me do it again, will post results.

[pbear]

Terminal is powerful but not very smart. It's on you to use exactly the right command strings.
If you get back an error or unexpected result, the first thing you should check is whether you made a mistake.