How can I manually decrypt the hard drive?

Question

I've just switched to Ubuntu 12.04 one year ago and moved all my photos, documents, etc to the 1TB main hard drive that has been encrypted during the installation process - not LVM but only the home folder.

I didn't record any key or passphrase when prompted... However, it only required the password to login in the system and have access to the files.

It happened that after one month of holiday I've forgotten my password so I've googled and found a way to change it:

from the recovery mode, I've selected the root shell and at the prompt I entered:

mount -rw -o remount /
passwd <username>
init 2

Desperately I've tried lots of passwords.. and after a while I've found the initial password written down.

I've set this password back again and now the system doesn't want to start up Ubuntu - it only loops in between the login screen - it doesn't say "Invalid password" - and a black screen and then back to the login screen.

So the system cannot decrypt the hard drive.

Could it be that the "init 2" has deleted some sort of info?

Looks like something has been altered by these password changes...

What could be done to recover my data? I know that Kali linux has an utility to decrypt WiFi by "listening" it. Could I use a similar program to find the passphrase?

Solution

Desperately I've tried lots of passwords.. and after a while I've found the initial password written down.

Do you mean you have recovered your old (original) password?

If yes, please repeat the procedure, enter in recovery mode as you did before and restore your password:

mount -rw -o remount /
passwd <username>
    Restore the old password
reboot

Hopefully Ubuntu will be able to decrypt your home directory now.

Could it be that the "init 2" has deleted some sort of info?

I don't think so. "init 2" is used to switch your current runlevel. It means you are leaving the recovery mode.

In addition,

I didn't record any key or passphrase when prompted... However, it only required the password to login in the system and have access to the files.

A key is used to decrypt the files. That key is protected so nobody but you can use it (if everybody could, you would have no security at all), so it only requires the password to decrypt the files because this is the way to unlock the key.

In the setup process, when you first configured your password and you chose to encrypt files, Ubuntu should have give you a restoration key, or an alternative way to decrypt your files in the event you could not log in the system.

So even if you just used your password, there is more story happening behind the scenes, so there is no way (or easy way if there is one) to recover the data if you lose both the password and the password-protected key or the special recovery-key.

Comments

[Gilles 'SO- stop being evil']

You can't decrypt your files without the password, otherwise that would defeat the purpose. That program you saw on Kali only decrypts some broken wifi protocols, and Ecryptfs (the system that Ubuntu uses to encrypt home directories) is not broken. It seems that you made some mistake when you set the password back, but we can't tell you what, because you didn't say what you did. How exactly did you set the password?

[Ed Heal]

(... not broken) - As far as we know at this moment in time. Brute force may be possible put that may take time (an lots of it)