If your files have been encrypted,
they are now encrypted stored in
/home/.ecryptfs/$USER/.Private/
So make sure you are looking in the correct dir.
Shut down your computer;
you can pull the plug, because shutting down will write files to your hard drive,
and might overwrite your deleted files.
Use a live cd/usb and use
extundelete to restore the files to an external drive.
The command with restore all will try to recover every deleted file:
Code: Select all
extundelete --restore-all /dev/sda1
/dev/sda1 should be the partition where the home-dir is located.
You can use
dd to make an image of the /dev/sda1 partition,
and to the recovering later. (dd will copy every bit, so even the deleted files, if they haven't been overwritten)
I think every file is encrypted separately, and have long strange names, like:
ECRYPTFS_FNEK_ENCRYPTED.longseriesofcharacters--
Remember to login with same user,
otherwise the key won't be correct and you will not be able to decrypt them.
Copy them back to
/home/.ecryptfs/$USER/.Private/
should make them accessible again.