I use Cryptkeeper to encrypt an folder on Ext4. By repairing the partition by gparted I got the lost+found folder. How do I decrypt those found files? They should be plain (though encrypted) text files.
1 Answer
If you were not able to recover the EncFS config file (normally called
.encfs6.xml
) then you're in trouble; it contains the actual key (stored in<encodedKeyData>
) that is unlocked with the passphrase (much like gpg & luks & others). Without it, you're left trying brute force.- If you're searching for the config file, it should start with
<?xml
... and contain a line with<creator>EncFS
...
- If you're searching for the config file, it should start with
If you recovered all files and their names, then decryption should work normally, basically just
encfs <encrypted dir> <mountpoint>
But often recovered files don't have their original names, so you might have trouble identifying which files were in the encrypted folder. And you'll definitely have trouble decrypting them without their original (encrypted) names.
If you did recover the config file, and had filename encryption enabled (it's standard settings do) then you might be able to modify the config file to not use filename encryption.
The element to change appears to be
<NameAlg>
and looks like this (in a standard config):<nameAlg> <name>nameio/block</name> <major>4</major> <minor>0</minor> </nameAlg>
Changing it to this should disable filename encryption, showing the recovered ("wrong") filenames but allowing you to at least see the decrypted contents of the files:
<nameAlg> <name>nameio/null</name> <major>1</major> <minor>0</minor> </nameAlg>