Friends--

Used photorec to recover some files that I hope contain two overwritten xournal .xoj files. I ran grep -rin (looking for a string that appeared in the name of each file) on the thousands of files restored, and came up with 4 possible files, named:
Code:
recupdir_141/f65949640.eCryptfs
recupdir_503/f189393168.eCryptfs
recupdir_503/f189393456.eCryptfs
recupdir_503/f189391096.eCryptfs
These files all currently reside in the /home/doug encrypted directory. I have rebooted and mounted that directory normally and am able to open other files in that directory.

I have tried opening these files with gedit (shows them all as binary files) and with xournal (after renaming as .xoj--this program merely reports "error in opening file"). Using cat and piping through less, I found that the first one has a lot of debug info and other things which look like pieces of other files (like lease info for wlan0 and eth0).

The 1096 file has stuff about charging and discharging, and the output of an ls -alh command, and binary info. 3168 is similar. 3456 has much less human readable text.

If my missing files are there, they are in the binary things I cannot read.

So I do not know if my missing .xoj files are in there, if they are encrypted or not, and especially how to deal with these files.

Any ideas how to recover these files? Or maybe my files are in the thousands of other files recovered.

My system:
12.04 lts Ubuntu
Used latest stable photorec--ran it against the empty space, since the missing files were already overwritten by another process. (I ran unison in the wrong direction!)

Thanks for helping me.