I am trying to recover files in the home directory on a ecryptfs partition on Ubuntu 11.10. I suspect it was not setup properly.
I followed instructions, I managed to mount the private directory, but the files are still encrypted (names are long, in CAPS, include _FNEK...). I'm not able to log in as the original user (don't know why, it bounces back to the login screen), so I had created a second user called user. I logged in as user and did sudo bash. Then I ran
ecryptfs-add-passphrase --fnek I entered the original 32-digit passphrase and got the two auth tok's and recorded them. Then I ran
mount -t ecryptfs /home/olduser/.Private /home/user/2Private
and entered the same 32-digit passphrase, selected aes, 16, y, y, entered the second auth tok (16 digits), yes or no, no. result: Mounted eCryptfs
The files are all visible in the /home/user/2Private but they are still encrypted. I was able to copy all the encrypted files to another hard drive, but I still don't know how to decrypt them.
I also checked the signature file with this: keyctl list @u and just the two 16-digit auth tok's are there, first one first.
I'm probably still a newbie; I got these instructions from several websites, including http://www.kaijanmaki.net/2009/10/26/recovering-files-from-ecryptfs-encrypted-home/comment-page-1/#comment-18444 and another site t http://hypnonomicon.com/attract/ which mentions the keyctl command.
dmesg says many instances of:
[ 6610.xxxxxx] Could not find key with description: [ccd56c174dd723c0]
[ 6610.xxxxxx] process_request_key_err: No key
[ 6610.xxxxxx] ecryptfs-parse-packet-set: Could not find a usable authentication token
[ 6610.xxxxxx] Valid eCryptfs headers not found in file header region or xattr region, inode 264203
[ 6610.xxxxxx] Either the lower file is not in a valid eCryptfs format, or the key could not be retrieved. Plaintext passthrough mode is not enabled; returning -EIO
(I also read that when one changes a user password when the home folder is encrypted, one has to change something in ecryptfs also. When I couldn't log in as my original username, I did add and rename and delete users in an attempt to be able to log in, and there was never any message about doing something for ecryptfs. The original message about not being setup properly was an error message displayed, and the above steps usually recover the private data, but not for me so far.)
In addition, I ran: ecryptfs-mount-private and it found my directory, mounted it in /tmp/, but the files and filenames are still encrypted.
Just found that someone else submitted this as a bug in launchpad two months ago, so action on it so far. From posts in other places, it has happened to more people than have reported it. https://bugs.launchpad.net/ubuntu/+source/ecryptfs-utils/+bug/1028532
Help is appreciated!!!
