How to Recover Deleted Encrypted fscrypt Files and EXT4 Partitions
-
Author:
Vladimir Artiukh
-
Editor:
Oleg Afonin
Deleting files from an EXT4 partition does not always mean they are lost permanently. However, data recovery becomes more complex if they were encrypted with fscrypt. This file-system-level encryption mechanism protects the contents of files and directories, so standard recovery methods may not produce the expected result. In this article, we will examine how fscrypt data is stored and encrypted in EXT4, what happens to files after deletion, and which methods can be used to locate and recover them.
- How fscrypt works
- How to recover deleted encrypted fscrypt files from an EXT4 partition
- Conclusion
- Frequently Asked Questions
- Comments
Loss of access to encrypted data most often occurs because the EXT4 file system itself is damaged. For example, as a result of a hardware or software failure of the computer. Accidental deletion of encrypted folders is also common. On USB flash drives, this becomes a real problem because files are deleted instantly, bypassing the system Recycle Bin.
Another typical scenario is connecting the drive to another system. Without a configured environment and the required key, fscrypt simply locks the folder, displaying an unintelligible set of characters instead of the actual file names. This is compounded by cases involving damage to inode metadata records and accidental deletion of entire logical partitions.
It is important to understand clearly: Hetman Software tools are not intended for password cracking and do not decrypt protected data. The main purpose of the program is to find and safely recover deleted encrypted files in their original form. To access the contents later, you will still need the original key or password.
The following demonstration of this process will use Windows as an example, but the program’s algorithms provide equally effective recovery of encrypted data from media running Linux and macOS.
How to Recover Deleted fscrypt Encrypted Files from an EXT4 Partition
How fscrypt works
Although encryption is a security standard, recovering locked files requires specific technical solutions. Native support for the fscrypt encryption mechanism has been implemented in the Linux kernel since version 4.1 for EXT4, and it is also actively used in modern distributions such as Ubuntu, Debian, Arch Linux, and Fedora.
Unlike full-disk encryption, fscrypt operates exclusively at the file system level. The utility protects only selected directories: file contents are securely encrypted with the AES-256-XTS algorithm, while file names are concealed using AES-256-CTS. However, the basic service information remains unencrypted.
It is this architectural feature that allows the algorithms in Hetman Partition Recovery to analyze unencrypted index descriptors and obtain precise data about file sizes and fragmentation. As a result, the program successfully finds all data and fully reconstructs the original directory structure, ready for further unlocking with your access key.
As for password storage: the system itself does not keep your password in plain text. Encrypted master keys are stored directly on the drive, usually in a special hidden system folder called .fscrypt. When a directory is unlocked, your personal password or system credentials are used to decrypt this master key, which is then securely loaded into the Linux kernel key storage, the so-called keyring.
| Stage | How fscrypt works | What happens to the data |
|---|---|---|
| 1. Encryption enabled | An fscrypt encryption policy is configured for an EXT4 directory or file system. | Encryption parameters and the method of key access are defined. |
| 2. Key creation | fscrypt uses an encryption key to protect file contents. | The key is not stored on the disk as a regular plain-text file. |
| 3. File encryption | File data is encrypted before being written to the disk. | Encrypted content is stored on the disk. |
| 4. Name encryption | fscrypt can encrypt not only file contents, but also file and directory names. | Original names are replaced with encrypted values. |
| 5. File access | After the key is unlocked, the operating system automatically decrypts the data during access. | The user sees the files in their normal form and can work with them. |
| 6. File deletion | After deletion, the file record may be removed from the file system, although its data may still remain on the disk. | Recovery becomes more difficult due to encryption and the need to access the corresponding key. |
| 7. Recovery | EXT4 is analyzed and remnants of deleted files are searched for. | Without the required key, the found encrypted data may be unusable for decryption. |
How to recover deleted encrypted fscrypt files from an EXT4 partition
STEP 1. Deleting encrypted files
For a clear demonstration, we prepared a special test environment. Two worst-case scenarios were simulated on a USB flash drive.
- The first partition contains an fscrypt-encrypted folder from which we intentionally deleted some files.
- The second partition contained the same encrypted data, but we deleted it completely using Disks in Ubuntu.
Let us see how Hetman Partition Recovery handles these tasks.
STEP 2. Creating and using images
To avoid risking the physical drive, we created an exact virtual image of it in advance and will work with that image.
Creating such a copy for any device is very simple. Connect the media to the computer and launch the program — it will automatically detect it and display it on the main screen.
Next, select the required disk and click Save disk on the top panel.
In the window that appears, specify the save path. A strict rule applies here: save the image file exclusively to another disk, not to the one you are currently copying.
After the process is complete, perform all further data search and recovery operations using this created file.
Now, to start working with the created image, it must be mounted. To do this, click Mount Disk on the top panel of the program and specify the path to the saved file.
The program will immediately connect the virtual drive and display it in the main window alongside the physical disks. It is now fully ready for safe scanning and further recovery of your data.
STEP 3. Recovering deleted files
On the mounted image of our flash drive, the program identified three partitions. However, we will work with only two of them. Let us begin scanning the first one.
Select Quick analysis. The program will automatically determine the file system that was previously used on the drive. Then start the scan.
During the analysis, the algorithm will detect the encrypted directory and request a password to access its contents.
When the scan is complete, the program will display the entire disk structure and highlight the found protected folder.
After opening it, you can browse both existing and previously deleted files. Using the preview window, you can easily verify the integrity of documents and videos before saving them.
Finally, simply select the required items and click Recover.
Note! Never save recovered files to the same disk from which you are recovering them. Be sure to choose another storage device or a folder on your computer’s hard drive to avoid overwriting lost information.
STEP 4. Searching for and recovering a deleted partition
Now we return to the main window with the list of drives. Our next step is to work with the second partition.
Note one important detail: this partition is deleted. However, the program’s algorithm successfully recognizes it. And this works flawlessly even if the partition was deleted in a completely different operating system.
Select it and start Quick analysis.
As in the previous case, the utility will quickly find the protected directory and immediately prompt you to enter the password to access your files.
As soon as the process is complete, you can open the folder, assess the condition of the files in the preview window, and save them. And, as we already emphasized, be sure to save the recovered data to another disk.
If the results of Quick analysis are insufficient, run Full analysis. It performs a more detailed scan of the drive and helps locate more deleted files and remnants of a damaged file structure.
Conclusion
Recovering deleted files encrypted with fscrypt from an EXT4 partition is a more difficult task than recovering ordinary files. Even if some data physically remains on the disk after deletion, access to its contents depends on the file system structure, metadata, and the relevant encryption keys.
Therefore, recovery success depends not only on whether the data has been overwritten, but also on the ability to correctly identify encrypted objects and obtain the required fscrypt keys. To increase the chances of recovery, after accidental file deletion it is recommended to stop writing new data to the EXT4 partition and perform recovery from its copy or disk image.
