Recover and decrypt a file

Recovery requires the encrypted .enc file and at least K compatible shares from its share set. Rehearse this procedure with non-sensitive data before relying on a share set for a real secret.

test-file.txt.enc

share_1.zip, share_3.zip, share_5.zip

FRACTUM 3 shares are enough to reconstruct

test-file.txt

Each share_N.zip contains Fractum's own source code from when it was created, and a copy of test-file.txt.enc only if --bundle-encrypted was used during encryption. Decrypt ignores both either way:

it only extracts the share_N.txt value from inside the zip
the encrypted file (test-file.txt.enc) must be supplied directly, as the command argument above
the bundled source code is there for you to rebuild Fractum by hand, if your own installation is the thing you lost

What you need

A Fractum installation or Docker image that you can run.
The encrypted file, for example test-file.txt.enc.
At least K share ZIP archives or extracted share files from the same share set.
A writable output location. Fractum stops if the decrypted output file already exists.

This is the normal recovery path. Put the encrypted file and the share archives in locations available to the CLI.

Manual installation

fractum decrypt ./test-file.txt.enc \
  --shares-dir ./shares \
  --verbose

Docker workflow

docker run --rm -it \
  --network=none \
  -v "$(pwd)/data:/data" \
  -v "$(pwd)/shares:/app/shares" \
  fractum-secure decrypt /data/test-file.txt.enc \
  --shares-dir /app/shares \
  --verbose

The CLI looks for ZIP archives and share files in the supplied directory. When metadata is present, it uses the share-set identifier stored in the encrypted file to select compatible shares. It validates a stored share hash when available, reconstructs the key, and verifies AES-GCM authentication before writing plaintext.

For a file named test-file.txt.enc, the successful output path is test-file.txt next to the encrypted input. Rename or remove an existing file at that path before retrying the command.

Use manual entry only when you have the individual share values but not usable share files. Fractum asks for the threshold, then the share index and Base64 or hexadecimal share value for each share. The current CLI does not ask for a total share count during this mode.

fractum decrypt ./test-file.txt.enc --manual-shares --verbose

With Docker, mount the directory containing the encrypted file. A shares directory is not required for manual entry:

docker run --rm -it \
  --network=none \
  -v "$(pwd)/data:/data" \
  fractum-secure decrypt /data/test-file.txt.enc \
  --manual-shares \
  --verbose

The interactive mode offers the same choice between a shares folder and manual values through prompts.

When recovery fails

Message or situation	What to check
Not enough shares	Obtain at least K valid shares from the same set.
Corrupted share hash	Replace the named share with a valid copy from its custodian.
No compatible shares	Check that the encrypted file and shares belong together; do not mix unrelated sets.
Output file already exists	Move or remove the old output before repeating the command.
Authentication failure	Stop and investigate the file and shares; do not trust an output that was not produced successfully.

After a successful rehearsal

Compare the recovered test file with the original, document what was required to assemble K shares, and update the recovery instructions before real custody begins. The security best practices page covers the human and physical side of that plan.