deleted files recovery

[sev64]

hi, I'm trying to recover deleted files on an ext4 filesystem encrypted with encfs 1.4.1
I first performed a clone of the offending disk with the dd command, after which I tried the recovery with different tools (extundete, ufs explorer, r-studio).
After the recovery, by remounting the filesystem, I can only see a part of the data. Many files are zero-size and others are hidden (the name is not decrypted).
have you had any experience with recovering deleted files?
Thanks in advance

[eingemaischt]

Hi,

did you find out how to do this? I am facing a similar problem. extundelete does not find any data, photorec recovers tons of files, but now I want to test which one may be an encrypted encfs file.

Is there any way to extract the masterkey from .encfs6.xml and (test-)decrypt a single file?

Or can I simply copy them to the encfs folder and they will get decrypted with random filenames?

[vgough]

You can use encfsctl to decrypt a single file. Random filenames won't work - the typical setup is to have filename chaining active which means that the full file path is used to determine the IV parameter used to decipher blocks from the file. So the filenames need to be recovered as well, unless the filesystem did not have this feature enabled.