ChromeOS stopped booting - can I recover my personal files?

[Vlad-BE]

Hi All, unfortunately today ChromeOS stopped booting on my Lenovo X260 all of a sudden. I only see Lenovo's logo going on and off in a loop. I have been using ChromeOS for the past year without any issues. I have not changed any settings in BIOS or so. It might be that Chrome OS automatically updated last night.

Any idea what I can do to get it booting or save my personal files?

• I managed to boot a live version of Ubuntu from a USB stick and can see my a drive where I believe my personal files are saved (though they seem to be somehow encrypted / inaccessible).
• Is there a way to decrypt those files (with my Google login credentials)?

[tejasraman]

Hello @Vlad-BE
Are you using ChromeOS flex or ChromeOS installed through brunch? Let me know and I can help you.

Tejas

[tejasraman]

I'm not 100 percent on encryption but I will look into it. I just saw your Reddit post so it's flex.

This discussions page is technically for brunch but I will help you with flex anyway. I'll look into recovering flex files with a Linux USB. (Weird that it encrypts stuff)

Tejas

[Vlad-BE]

Yes absolutely! I am based in Europe so still online for the next 5+ hrs. :) Thanks again!

[tejasraman]

As for brunch, I really think it can be troublesome (you need to update brunch before ChromeOS) but I use it anyway :)

Tejas

[Vlad-BE]

Yeah exactly - I was too hasty and excited about early updates before Brunch was updated... My bad!

[tejasraman]

It's ok, flex shouldn't crash either... weird that it did.

Maybe the bootloader is broken? If so we can fix it.

I will be back to you soon.

Tejas

[Vlad-BE]

I think the bootloader is broken. When I went to a 'legacy BIOS mode', I cannot see any OS in the launch list. Quite weird because I have not absolutely done anything other than surfing web. It's just disappeared. Hence I can only run live USB OS (Chrome OS or Ubuntu). Thanks again!

[tejasraman]

Hi! Could you go to the EFI mode?

Tejas
(P.S we probably need to repair the bootloader)

[tejasraman]

Sorry I couldn't make a VM for Flex but could you please boot into Ubuntu in EFI mode on your laptop?
It is a thinkpad x260, right?

[Vlad-BE]

No worries. Yes I am back to "UEFI only" mode - and yes I can boot into Ubuntu Live USB.

[tejasraman]

Could you please run "sudo -s" and then type "cd /boot/efi/EFI/" and then "ls" and than take a screenshot?

[Vlad-BE]

See below:

[tejasraman]

Could you run cd /boot && ls?

[tejasraman]

Oh, and could you open "Disks" and take a screenshot for me?

[Vlad-BE]

Here you:

[tejasraman]

Can you click on "EFI-SYSTEM" and take another screenshot?

[tejasraman]

FYI Flex needs "EFI Mode" to work.

[Vlad-BE]

[tejasraman]

Could you run udisksctl mount -b /dev/sda12?

[Vlad-BE]

Yup - it says "mounted":

[tejasraman]

Can you run this: umount /dev/sda12 && exit && udisksctl mount -b /dev/sda12? Sorry, I made you mount it as root - that won't work.

This unmounts it, exits "sudo -s", and mounts it again.

[tejasraman]

You know @heitre you could be right. The last time I suspected SSD failure though it ended up needing an OS reinstall. (Some apps that relied on a particular windows mount point didn't work)

[tejasraman]

FSCK is not for decryption. FSCrypt is.

As for SSDs, the SK Hynix Gold S31 and Adata SU800 are really reliable in my experience.

[Vlad-BE]

Running the 'check disk' command worked for the partition where I believe my personal data is saved. Hopefully this means that this partition is safe?

In terms of FSCrypt, would you be so kind and help me install this tool? I have been following some instructions online but get this error:

EDIT:
I have also scanned the SSD for failures in Lenovo's boot diagnostics option. After a 5 min scan, everything was "green" (passed successfully).

[Vlad-BE]

Thanks @heitre & @tejasraman! So I had to download and install the Fscrypt tool manually. Now I am not sure how to run it.

I suspect that my files are here:

This is what I see when I open that partition:

Would you be so kind and guide me to unlock the files please?

I cannot thank you enough!

[heitre]

fscrypt status
see the status command here https://wiki.archlinux.org/title/Fscrypt

(Pretty sure chromeos is using some encrypted.key - see the screenshot). We are just randomly issuing commands without understanding). Sorry.

As for SSDs, the SK Hynix Gold S31 and Adata SU800 are really reliable in my experience.

Ask in reddit datahoarder regarding any disk/ssd/hdd - The answer for reliability is a number between 1 sec to any large number.

[Vlad-BE]

Thanks @heitre ! Btw @tejasraman mentioned that I may need a eCryptfs tool from Chrome OS files - do you have any experience with it?

[heitre]

eCryptfs is easy. We all know/can learn commandline. But we do not know how it is implemented inside chromeos. We do not know which password? Most likely it is not your direct password; it should be some KEY file. May be this is also corrupted. see your screenshot.

Sorry. It is over. Nothing can be done.

[tejasraman]

Ya that's the exact reason I didn't want to meddle with eCryptFS. The thing is that fscrypt is a Google-developed utility and they use it in ChromeOS. Real Chromebooks use a TPM-stored Google account "protector" to decrypt the files.

Google might have messed up eCryptFS and we don't know. I'm so sorry @Vlad-BE but if the files are in GDrive you can get them.

Also your quote "everyone knows/can learn command line" is very true :) @heitre

[tejasraman]

What id inside unencrypted? And try "fscrypt unlock yourencrypteddir"

[Vlad-BE]

The unencrypted folder contains this:

So I write this for instance?
fscrypt unlock /dev/sda1
or
fscrypt unlock /media/ubuntu/d5ede90c-273a-49d0-a5c7-2638e67a3cc4

[tejasraman]

The second one.

[Vlad-BE]

This is what I get - am I doing it correctly?

[tejasraman]

Maybe /encrypted ?

[Vlad-BE]

Looks same to me:

Weirdly, the encrypted folder looks empty.

[tejasraman]

What about /home/chronos ? (yes it is C-H-R-O-N-O-S)

[Vlad-BE]

Ah got it! Sorry! I tried a couple of options but either it says that the directory is not encrypted, or that I do not have sufficient permissions (as if I was not the owner).

[tejasraman]

Add sudo the beginning?

[Vlad-BE]

Apparently "not encrypted":

[tejasraman]

What is inside that home directory?

[Vlad-BE]

[tejasraman]

Try "chronos"

[Vlad-BE]

It looks empty:

And here with commands (sudo and non sudo):

[tejasraman]

It might be eCryptFS as well (Some older chromebooks used it even in modern ChromeOS versions)

[tejasraman]

If so, there's not much we can do about the data. I know your ssd is fine but I wonder how the OS got corrupted.

[tejasraman]

I'll try.
I'll send you a new EFI.
Can you

• Reformat the Efi partition as fat16
• Add the Efi files to that partition?

[Vlad-BE]

Uff, with your help for sure - but how much more can I bother you...? :D

[tejasraman]

True :-) but it's pretty low effort to replace the EFI.

[Vlad-BE]

I cannot thank you enough. I would be grateful if you can send me even a link to instructions for the EFI reformatting / loading new files (or write it here if you have a moment and patience with me). Thanks!

[Vlad-BE]

@tejasraman - It seems to me that I already have EFI partition as fat16?

So I would just need to replace / load new files?

[tejasraman]

It’s probably eCryptFS then.

[Vlad-BE]

And I cannot use similar tool like fscrypt to decrypt eCryptFS?

[tejasraman]

Can you run these commands in order:
sudo apt update
sudo apt install dosfstools
sudo mkfs.vfat /dev/sda12
sudo e2label /dev/sda12 "EFI"
udisksctl mount /dev/sda12

And then put the contents of https://1drv.ms/u/s!AkBuD6XsET8xgYwJHBXY7H_kmPc-Pw on the new partition.

[tejasraman]

This erases the partition (just to make sure) and labels it as "EFI"

[Vlad-BE]

have a look - I made it to the last step before copying the files. It seems that the EFI label has not been applied:

[Vlad-BE]

@tejasraman But I guess just copy those files from You in the EFI partition, even if the label may not have changed?

[Vlad-BE]

Weirdly, in the Disks app, it looks normal? Maybe I can change the name here?

[tejasraman]

You can. Remember to use udisksctl on it and transfer the files.

[Vlad-BE]

Thanks @tejasraman! So I copied your new EFI files into the formatted 'EFI' partition. Unfortunately, that did not help: the PC is still in a loop: Lenovo welcome screen - black screen - Lenovo welcome screen... :(

Do you have any more ideas please? I basically need to save the get some data from the SSD disk.

1. I wonder if I should try the eCryptFS decryption method too?
2. Or can something be changed in the BIOS settings to make this thing boot (i.e. secure boot, TMP chip or so)?

[tejasraman]

I'm not sure. Maybe try boot repairing the new EFI?

Just to get a log and see if there are changes and maybe repair it?

[Vlad-BE]

@tejasraman See here the Boot Repair report - what do you think?
Boot-Info_20221024_1655.txt

[Vlad-BE]

Hi @tejasraman, I guess there is not much I can do with this Boot Repair log, right? What do you think? I want to make sure it is the right time to just give it up and format the disk.
Boot Repair Info.txt
Thanks again for everything!

[tejasraman]

It still doesn't boot? The EFI is fine now (the log says so) so the file corruption runs deeper than we can fix.

IMHO just give up.

[Vlad-BE]

Thanks @tejasraman - totally understand. I really appreciate all your help and support throughout this journey..!

[tejasraman]

I'm so sorry I couldn't help...