File recovery via testdisk / photorec

File recovery via testdisk / photorec

[tmg]

Dear developers and users,

I've searched a lot around the web, but didn't find any satisfying answer.
Consider the following situation:

- You have your home directory /home/<user> encrypted with ecryptfs
- You know your passphrase, that is, no trouble to decrypt the directory

Question: How do you recover deleted files from the mounted (decrypted) home 
or the ecryptfs container?

All the ecryptfs recover strategies I've read so far were like
- use a livecd
- go and fire ecryptfs-recover-private, and mount your home readonly
- copy your files to a save place

But what about files that I can't regularly copy, because they are deleted?

If it was an unencrypted ext4, I would do (using ubuntu)
$ dd if=/dev/sda of=/media/user/sda.img
$ testdisk /media/user/sda.img

Can we run testdisk on the .ecryptfs container, or even the mounted home?


Thank you for any suggestion and best regards,

TMG