Recovering .eCrypts files on sbd1

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Robb71
Posts: 2
Joined: 15 Feb 2019, 21:26

Recovering .eCrypts files on sbd1

#1 Post by Robb71 »

I proved the adage that a little knowledge in dangerous.
Long story short, when one of my RAID 1 drives went bad, after installing a replacement with one button in bios I ended up reformatting my drive. Linux then refused to recognize the new format, I managed to get windows to run testdisk on the dirive and it recovered some files which I put on my new hardrive. (Although the file size seem low, I am hoping to recover something, I am hoping Linux mint encryption compresses the files.)

My problem is I am having difficulty getting ecryptfs to decrypt the files. when i use

sudo ecryptfs-recover-private /dev/sdb1

I get

INFO: Searching for encrypted private directories (this might take a while)...
find: ‘/run/user/1000/gvfs’: Permission denied

after
sudo umount /run/user/1000/gvfs

I get
sudo ecryptfs-recover-private /dev/sdb1
INFO: Searching for encrypted private directories (this might take a while)...
INFO: Hint: click 'Places' and select your hard disk, then run this again.
ERROR: No private directories found; make sure that your root filesystem is mounted.


I saw this this as a solution posted on your forum.


mkdir crypted decrypted
mv recup_dir.*/*.eCryptfs crypted
sudo mount -t ecryptfs -o ecryptfs_passthrough=n,key=passphrase,ecryptfs_enable_filename_crypto=n,ecryptfs_key_bytes=16,ecryptfs_cipher=aes crypted decrypte
Note that you need to know the key size (here 16) and the algo (aes in this example).

Unfortunately I am not as familiar with terminal commands as I am with GUI, but I recognize the above example given by Cgrenier creates two dir in the home location. I need to make these two dir on sdb1 for the hard drive that I reinstalled linux on was an old HD with only 320GB. So I am afraid the encrypted and decrypted files will not all fit on the drive with my home partition on it. I do have 1.6 TB free on sbd1. I can easily make the two dir crypted and decrypted on sbd1 with the GUI but I don’t really know how to interact with sbd1 using the terminal. How can I write the move command to move all the .eCryptfs into the crypted folder on sdb1?

The second question I have is with the Note “that you need to know the key size (here 16) and the algo (aes in this example).” what is the key size? Is that the number of letters in the encryption password?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovering .eCrypts files on sbd1

#2 Post by cgrenier »

To become root, use "sudo -s"
You may get the correct ecryptfs parameters from another Linux mint installation.

Robb71
Posts: 2
Joined: 15 Feb 2019, 21:26

Re: Recovering .eCrypts files on sbd1

#3 Post by Robb71 »

Thank you for responding, Can you explain your note you posted to another user, “Note that you need to know the key size (here 16) and the algo (aes in this example).” what is the key size you are referring to, and how can i figure out what number to use?

Locked