3

I have managed to recover files from a disk with a damaged partition table using photorec. Photorec does not preserve the file name or file structure so all I have are a bunch of randomly named files such as 013892.ecryptfs 02189421.ecryptfs etc.

The original system had an encrypted home folder, and I know the login password. Is there any way to decrypt ecryptfs files?

jenny92718
  • 31
  • 2

1 Answers1

1

I had the same problem and I've been able to fix it by following the info provided in this link using the command 'encryptfs-recover-private':

https://forum.cgsecurity.org/phpBB3/viewtopic.php?t=7535

It works well. Just an extra hint; when you perform encryptfs-recover-private specify the directory where your encrypted files are located; otherwise the command will search for the entire partition and very likely it will fail.

Good luck

David Sanz
  • 11
  • 2
  • Thanks for the tip. I'm going to move all of the recovered encrypted files to a new dir, and run the command then cross my fingers for the best result. In your experience, do you recall if encrypted files become available in the correct format you were expecting them to be? – DrZoo Dec 24 '21 at 20:12