Home / ubuntu / Questions / 932162
In Process
mahdiar
Asked: 2017-07-05 23:26:58 +0800 CST

How to recover encrypted home after password changing?

  • 772

I had a simple password for years! Yesterday I changed my password to a stronger one, but I forgot it. So I used recovery mode and changed my password. After that, I couldn't login to my account. It returned to the login page. So I reinstalled Ubuntu. ( It's in another hard drive so my home folder is safe and unchanged. ) But login loop was there. So I reset .ICEauthority and I can login to my account now. But the problem is my home folder is encrypted and now I can't see my files. ( I know my last login password and I know my passphrase, too, and I have used them before to decrypt the data. ) Now : When I click on Access-Your-Private-Data.desktop nothing happens.

mahdiar@mahdiar-ubuntu-pc:~$  ecryptfs-mount-private
ERROR: Encrypted private directory is not setup properly

mahdiar@mahdiar-ubuntu-pc:~$     sudo ecryptfs-recover-private ~/.ecryptfs/mahdiar/.Private
[sudo] password for mahdiar: 
INFO: Found [/home/mahdiar/.ecryptfs/mahdiar/.Private].
Try to recover this directory? [Y/n]: 
INFO: Found your wrapped-passphrase
Do you know your LOGIN passphrase? [Y/n] 
INFO: Enter your LOGIN passphrase...
Passphrase: 
Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]
Info: Check the system log for more information from libecryptfs

+++ 14-7-2017

I remember that first I changed my password graphically and when I forget it I use passwd to change it . So should I use that forgotten password ?

I know 9 characters of password . Maybe 4 or 5 first characters are forgotten .

encryption

3 Answers

  1. Maybe this answer helps you: Unwrapping passphrase and inserting into the user session keyring failed

    I suspect that your passphrase has been wrapped using the "strong password" you could not remember. However, if you have your unwrapped Passphrase at hand, you could directly use it in the sudo mount -t ecryptfs command as in the referred question.

    If that works, you can at least get your data out.

    • 2

  2. Unless you have the unwrapped password, there is very little you can do. If you have a backup, then you can restore your files. If there was a way to recover the files without knowing the password, then everyone would be able to do that which would be a big security risk.

    • 2

  3. From how I understand the sequence of events, you couldn't remember the previous passphrase.

    • If you can't remember the passphrase then you can't unlock the volume encryption key with ecryptfs-unwrap-passphrase.
    • If you don't have a copy of the unwrapped volume key (or one wrapped with a passphrase that you remember) you can't decrypt the volume.

    If you still know most of the lost passphrase or its pattern you could use word list generator to create a word list based on that and try to find the right one to decrypt the volume. Other than that the encrypted data is inaccessible.

    • 1