1

After running ecryptfs-recover-private --rw ./ and doing some basic tasks on the mounted directory it seems that all files have been deleted somehow, yet the folder structure remains. This is very absurd as I certainly haven't touched a majority of the files now missing, and the folder structure goes to a depth of five at least. The directory has been remounted several times afterwards and the machine rebooted to ensure it wasn't just a temporary bug.

A quick rundown of what was done, in order:

  • run diff -r a b | less where a is the mounted private directory and b is a similar folder on another drive.
  • delete a single file inside a directory in the root of the mount path.
  • subsequently delete the entire directory the file resided in.
  • open a plaintext file in vim, before promptly closing it.
  • run ls to find the plaintext file is missing, and so is every other file. The less command also suddenly started spitting out "missing file" errors.

SMART tests dictate that the drive is healthy. What could have possibly gone wrong and is there a way to recover or check for any traces of the files?

1

I'd guess that you accidentally deleted all your files, or all the encrypted files themselves (in .Private for example), probably in one of the "delete" steps like this one:

  • subsequently delete the entire directory the file resided in.

Normally ecryptfs-recover-private "is intended to help ... recover data from their encrypted home or encrypted private" folders, so the first step after using it would be to backup all your files.

If you don't have a backup copy of the files (the encrypted .Private folder or the actual files), then there is a chance the deleted files might still be recoverable with an undelete utility (like testdisk among others, depending on your filesystem).

If they are recoverable they should still be encrypted (there's no point in using eCryptfs if they weren't), but could be decrypted again with the wrapped-passphrase file or the mount passphrase (which eCryptfs advises to make a backup copy of after creating an encrypted folder).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.