Recover data from encrypted home folder

[skibum505]

I am trying to recover my home folder from a corrupted Mint 18.3 install.
Running from the live Mint 19 USB

1. Trying “automatic” method (described in https://help.ubuntu.com/community/Encry ... eDirectory)

Result: did not find the encrypted directory (it was mounted). Output from terminal:

Code: Select all

mint@mint:~$ sudo ecryptfs-recover-private
INFO: Searching for encrypted private directories (this might take a while)...
find: ‘/run/user/999/gvfs’: Permission denied

2. Trying "manual" method (same source)
Result: "Error mounting eCryptfs: [-20] Not a directory"

Code: Select all

mint@mint:~$ sudo fdisk -l
Disk /dev/loop0: 1.7 GiB, 1860165632 bytes, 3633136 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sda: 931.5 GiB, 1000204886016 bytes, 1953525168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0x000505cf

Device     Boot Start        End    Sectors   Size Id Type
/dev/sda1  *     2048 1953523711 1953521664 931.5G  7 HPFS/NTFS/exFAT

Disk /dev/sdb: 931.5 GiB, 1000204886016 bytes, 1953525168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0x1e50ca6d

Device     Boot   Start        End    Sectors  Size Id Type
/dev/sdb1  *       2048     999423     997376  487M 83 Linux
/dev/sdb2       1001470 1953523711 1952522242  931G  5 Extended
/dev/sdb5       1001472 1953523711 1952522240  931G 8e Linux LVM

mint@mint:~$ sudo ecryptfs-add-passphrase --fnek
Passphrase: 
Inserted auth tok with sig [8b83844bf807ce7c] into the user session keyring
Inserted auth tok with sig [0467de21eced0219] into the user session keyring
mint@mint:~$ sudo mkdir -p /home/Private
mint@mint:~$ sudo mount -t ecryptfs /dev/sdb5/home/gary/.Private /home/Private
Passphrase: 
Select cipher: 
 1) aes: blocksize = 16; min keysize = 16; max keysize = 32
 2) blowfish: blocksize = 8; min keysize = 16; max keysize = 56
 3) des3_ede: blocksize = 8; min keysize = 24; max keysize = 24
 4) twofish: blocksize = 16; min keysize = 16; max keysize = 32
 5) cast6: blocksize = 16; min keysize = 16; max keysize = 32
 6) cast5: blocksize = 8; min keysize = 5; max keysize = 16
Selection [aes]: aes
Select key bytes: 
 1) 16
 2) 32
 3) 24
Selection [16]: 16
Enable plaintext passthrough (y/n) [n]: n
Enable filename encryption (y/n) [n]: y
Filename Encryption Key (FNEK) Signature [8b83844bf807ce7c]: 0467de21eced0219
Attempting to mount with the following options:
  ecryptfs_unlink_sigs
  ecryptfs_fnek_sig=0467de21eced0219
  ecryptfs_key_bytes=16
  ecryptfs_cipher=aes
  ecryptfs_sig=8b83844bf807ce7c
WARNING: Based on the contents of [/root/.ecryptfs/sig-cache.txt],
it looks like you have never mounted with this key 
before. This could mean that you have typed your 
passphrase wrong.

Would you like to proceed with the mount (yes/no)? : yes
Would you like to append sig [8b83844bf807ce7c] to
[/root/.ecryptfs/sig-cache.txt] 
in order to avoid this warning in the future (yes/no)? : yes
Successfully appended new sig to user sig cache file
Error mounting eCryptfs: [-20] Not a directory
Check your system logs; visit <http://ecryptfs.org/support.html>

I checked the system logs as described in the tutorial. The only relevant line appeared to be:
from auth.log

Jul 24 18:44:54 mint sudo: mint : TTY=pts/0 ; PWD=/home/mint ; USER=root ; COMMAND=/bin/mount -t ecryptfs /dev/sdb5/home/gary/.Private /home/Private
Jul 24 18:44:54 mint sudo: pam_unix(sudo:session): session opened for user root by (uid=0)

I saved both logs and can reproduce if need be.

3. Trying method described in <viewtopic.php?t=134231#p720340>

Result:

Code: Select all

mint@mint:~$ sudo mount /dev/sdb5 /mnt
mount: /mnt: unknown filesystem type 'LVM2_member'.
mint@mint:~$ sudo mount /dev/sdb2 /mnt
mount: /mnt: wrong fs type, bad option, bad superblock on /dev/sdb2, missing codepage or helper program, or other error.

[Laurent85]

Proceed this way :

Code: Select all

mint@mint:~$ sudo umount /dev/mapper/mint--vg-root
mint@mint:~$ sudo mount /dev/mapper/mint--vg-root /mnt
mint@mint:~$ sudo ecryptfs-recover-private /mnt/home/.ecryptfs/gary/.Private

[skibum505]

OK here is what I got:

Code: Select all

mint@mint:~$ sudo umount /dev/mapper/mint--vg-root
umount: /dev/mapper/mint--vg-root: not mounted.
mint@mint:~$ sudo mount /dev/mapper/mint--vg-root /mnt
mint@mint:~$ sudo ecryptfs-recover-private /mnt/home/.ecryptfs/gary/.Private
INFO: Found [/mnt/home/.ecryptfs/gary/.Private].
Try to recover this directory? [Y/n]: y
INFO: Found your wrapped-passphrase
Do you know your LOGIN passphrase? [Y/n] y
INFO: Enter your LOGIN passphrase...
Passphrase: 
Inserted auth tok with sig [6932dc4cba5451af] into the user session keyring
mount: /tmp/ecryptfs.VPXMZoFl: mount(2) system call failed: No such file or directory.
ERROR: Failed to mount private data at [/tmp/ecryptfs.VPXMZoFl].
mint@mint:~$ 

Thanks