Ubuntu – What’s lost+found and where did it come from

You can use cryptmount to encrypt a filesystem, also if the filesystem is on a file.

The cryptmount manual page has a very simple and detailed explanation that I report (modified) here, and it do mention explicitly a file based filesystem.

• Step 1
  Add an entry in /etc/cryptmount/cmtab, as follows:

  mycrypt {
      dev=/media/data/mycrypt dir=/home/enzotib/mycrypt
      fstype=ext4 mountoptions=defaults cipher=twofish
      keyfile=/etc/cryptmount/mycrypt.key
      keyformat=builtin
  }
  

  where /media/data/mycrypt is the support file created by dd and /home/enzotib/mycrypt is the desired mountpoint.

• Step 2
  Generate a secret decryption key

  sudo cryptmount --generate-key 32 mycrypt
  

• Step 3
  Execute the following command

  sudo cryptmount --prepare mycrypt
  

  you will then be asked for the password used when setting up the key

• Step 4
  Create the filesystem

  sudo mkfs.ext4 /dev/mapper/mycrypt
  

• Step 5
  Execute

  sudo cryptmount --release mycrypt
  

• Step 6
  Now mount the filesystem

  mkdir /home/enzotib/mycrypt
  cryptmount -m mycrypt
  

  then unmount it

  cryptmount -u mycrypt
  

Also, if you need to crypt a directory, encfs may be worth to take into consideration.

I was successfully able to recover all my files using a backup Superblock! After TestDisk was not able to help me, I tried an approach from a related question. For the sake of clarity, here the steps I took to recover my file structure:

1. Make sure your drive is unmounted.

2. Find out your backup Superblocks via

   dumpe2fs /dev/<drive-id> | grep -i superblock

   e.g. dumpe2fs /dev/sdb | grep -i superblock

3. Check the file system based on one of the Superblocks but do not apply any changes yet to see whether this particular Superblock is structurally intact.

   fsck.ext4 -v -n -C 0 -b <Superblock> /dev/<drive-id>

   e.g. fsck.ext4 -v -n -C 0 -b 2654208 /dev/sdb

   -v makes the command verbose to show more details, -n makes sure no attempts to fix the file system are made by always answering 'no' to each prompt, -C 0 displays a progress bar and -b defines the starting position of a Superblock given by the previous step.

4. If a suitable Superblock has been found, let fsck.ext4 fix your file system by replacing the -n with -y to accept all fixes automatically.

   fsck.ext4 -v -y -C 0 -b <Superblock> /dev/<drive-id>

5. Reboot and mount the drive.

In my case, the first level of directory names could not be recovered. Thus they could all be found based on their inode name in the lost+found directory, which is hidden.