Decrypt Cloud Backup

Let’s assume you have created an encrypted backup and uploaded it to the cloud. It is located on your NAS, but that may be broken. Since gocryptfs encrypts both the file contents and the file names, after downloading the data from the cloud, you will initially only see gibberish (folders and files with names like a82…z91).

Here are the methods for different operating systems on how you can access your data.

IMPORTANT: Try at least one of those methods on test files before you start a real backup!

Prerequisites

You strictly need two things:

1. The downloaded, encrypted folder (which must contain the gocryptfs.conf file).
2. The Password (or the Master Key file).

Method 1: With BmuS native

Use this if you want to use the convenient --restore features of the script (filtering by date, restoring specific files).

1. Prepare the Data

Download your encrypted backup folder (or specific parts of it) from your cloud provider (OneDrive, Google Drive, etc.) to your local machine.

2. Place the Data

BmuS expects encrypted data in the folder defined by ENCRYPTION_CIPHERTEXT_DIR. By default, if your BACKUP_PATHis /mnt/workstation, the expected path is: > /mnt/workstation/encrypted

• Action: Copy your downloaded cloud files into /mnt/workstation/encrypted.
• Check: Ensure that /mnt/workstation/encrypted/gocryptfs.conf exists.

3. Execute the Restore List

Now, tell BmuS to look at the “encrypted” source. It doesn’t know (or care) that these files just came from the cloud.

sudo bash /home/pi/bmus.sh --restore --source encrypted --list

What happens now?

1. BmuS mounts the folder to /mnt/backup_decrypted.
2. It prompts you for your password (if not using a password file).
3. It lists the decrypted filenames (clear text) in the terminal.

4. Restore Files

You can now perform a standard restore operation:

sudo bash /home/pi/bmus.sh --restore --source encrypted --date 2026-01-12 --target /home/pi/my_restored_files

Method 2: With BmuS Docker (if installed)

Scenario A: Just “Peek” inside (List Files)

Use this command to list the decrypted contents without restoring anything yet.

docker run --rm -it --privileged \
  -v "/home/user/downloads/cloud_backup:/mnt/workstation/encrypted" \
  -v "/path/to/your/bmus/config:/config" \
  backmeupscotty/bmus:v26.4 \
  --restore --source encrypted --list

Breakdown:

• --rm: Removes the container automatically after it finishes (clean).
• -it: Interactive mode (so you can see the output).
• --privileged: Required for FUSE/mounting gocryptfs.
• -v ...:/mnt/workstation/encrypted: The Trick. We map your local download to exactly where BmuS expects encrypted NAS files.
• -v ...:/config: Maps your config folder so BmuS finds your encryption password file.

---

Scenario B: Restore to a Local Folder

Use this to actually decrypt and copy files to a folder on your host machine.

docker run --rm -it --privileged \
  -v "/home/user/downloads/cloud_backup:/mnt/workstation/encrypted" \
  -v "/home/user/restored_files:/target" \
  -v "/path/to/your/bmus/config:/config" \
  backmeupscotty/bmus:v26.4 \
  --restore --source encrypted --date 2026-01-12 --target /target

Key Difference:

• -v "/home/user/restored_files:/target": We create a generic mount point inside the container (/target) and map it to where you want the files on your Host.
• --target /target: We tell BmuS to dump the decrypted files into that container path (which ends up on your Host).

---

Scenario C: Using an Existing Running Container

If your BmuS container is already running and you copied the cloud files to the PC/Host:

1. Copy files: Put the downloaded cloud files into the encrypted folder on your mapped volume (e.g., /volume1/backup/encrypted).
2. Execute: Run the command inside the existing container.

# syntax: docker exec -it <container_name> bash /bmus.sh <arguments>

docker exec -it bmus bash /bmus.sh --restore --source encrypted --list

(Note: This assumes your running container already has the volumes mapped correctly).

Method 3: On Linux (Native)

This is the “native” way, as BmuS runs here.

1. Create a mount point: Create an empty folder.
   
   mkdir /home/user/restore_data
   
2. Decrypt (Mount): Use gocryptfs to mount the encrypted folder into the empty folder.
   
   gocryptfs /path/to/download_from_cloud /home/user/restore_data
   
   You will be asked for the password.
   
3. Access: Now you can go into /home/user/restore_data and see all files in plain text. You can now copy them out (cp -r ...).
   
4. Unmount: When finished, unmount the folder:
   
   fusermount -u /home/user/restore_data

Method 4: On Windows

If you have lost your backup, you can download the cloud data to a Windows PC. Since gocryptfs is Linux-based, a tool is required.

The best tool for this is cppcryptfs.

1. Download: User downloads cppcryptfs (Open Source, no installation required).
2. Open: Start the program.
3. Select: Select the downloaded encrypted folder.
4. Password: Enter the password.
5. Mount: Click on “Mount”.
6. Result: The folder opens as a new drive (e.g., Drive Z:). All files are available there in plain text.

Method 5: With a Graphical Interface (Linux / macOS / Windows)

If you want to avoid the command line, use SiriKali.

• SiriKali is a GUI that supports gocryptfs (and others).
• You simply drag the encrypted folder into the window, enter the password, and the folder opens.