1

I use Cryptkeeper to encrypt an folder on Ext4. By repairing the partition by gparted I got the lost+found folder. How do I decrypt those found files? They should be plain (though encrypted) text files.

1
  • Do you still have the EncFS config file? Or a backup of it? And did you recover the original filenames, or even have filename encryption enabled in EncFS?
    – Xen2050
    Dec 2, 2018 at 3:08

1 Answer 1

0
  1. If you were not able to recover the EncFS config file (normally called .encfs6.xml) then you're in trouble; it contains the actual key (stored in <encodedKeyData>) that is unlocked with the passphrase (much like gpg & luks & others). Without it, you're left trying brute force.

    • If you're searching for the config file, it should start with <?xml... and contain a line with <creator>EncFS...
  2. If you recovered all files and their names, then decryption should work normally, basically just
    encfs <encrypted dir> <mountpoint>

  3. But often recovered files don't have their original names, so you might have trouble identifying which files were in the encrypted folder. And you'll definitely have trouble decrypting them without their original (encrypted) names.

    • If you did recover the config file, and had filename encryption enabled (it's standard settings do) then you might be able to modify the config file to not use filename encryption.

      The element to change appears to be <NameAlg> and looks like this (in a standard config):

      <nameAlg>
          <name>nameio/block</name>
          <major>4</major>
          <minor>0</minor>
      </nameAlg>
      

      Changing it to this should disable filename encryption, showing the recovered ("wrong") filenames but allowing you to at least see the decrypted contents of the files:

      <nameAlg>
          <name>nameio/null</name>
          <major>1</major>
          <minor>0</minor>
      </nameAlg>
      

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .