From owner-freebsd-geom@FreeBSD.ORG  Thu Jun 19 02:32:27 2008
Return-Path: <owner-freebsd-geom@FreeBSD.ORG>
Delivered-To: freebsd-geom@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id F24E81065684
	for <freebsd-geom@freebsd.org>; Thu, 19 Jun 2008 02:32:27 +0000 (UTC)
	(envelope-from gcr@tharned.org)
Received: from QMTA07.emeryville.ca.mail.comcast.net
	(qmta07.emeryville.ca.mail.comcast.net [76.96.30.64])
	by mx1.freebsd.org (Postfix) with ESMTP id C8F3E8FC2A
	for <freebsd-geom@freebsd.org>; Thu, 19 Jun 2008 02:32:27 +0000 (UTC)
	(envelope-from gcr@tharned.org)
Received: from OMTA03.emeryville.ca.mail.comcast.net ([76.96.30.27])
	by QMTA07.emeryville.ca.mail.comcast.net with comcast
	id fbrN1Z0060b6N64A70Cj00; Thu, 19 Jun 2008 02:16:26 +0000
Received: from nc8000.tharned.org ([75.145.12.185])
	by OMTA03.emeryville.ca.mail.comcast.net with comcast
	id feGM1Z0093zZBGT8PeGRBf; Thu, 19 Jun 2008 02:16:26 +0000
X-Authority-Analysis: v=1.0 c=1 a=4nuRF4y9Hj5goEdpS5UA:9
	a=peNNzpEutZSk3lHLx513p3YUZCwA:4 a=LY0hPdMaydYA:10
Received: from nc8000.tharned.org (localhost [127.0.0.1])
	by nc8000.tharned.org (8.14.2/8.14.2) with ESMTP id m5J2GK20017288;
	Wed, 18 Jun 2008 21:16:21 -0500 (CDT) (envelope-from gcr@tharned.org)
Received: from localhost (gcr@localhost)
	by nc8000.tharned.org (8.14.2/8.14.2/Submit) with ESMTP id
	m5J2GKjZ017285; Wed, 18 Jun 2008 21:16:20 -0500 (CDT)
	(envelope-from gcr@tharned.org)
Date: Wed, 18 Jun 2008 21:16:14 -0500 (CDT)
From: Greg Rivers <gcr@tharned.org>
To: RW <fbsd06@mlists.homeunix.com>
In-Reply-To: <20080618225407.1337ad03@gumby.homeunix.com.>
Message-ID: <alpine.BSF.1.10.0806182101330.16812@nc8000.tharned.org>
References: <20080618225407.1337ad03@gumby.homeunix.com.>
User-Agent: Alpine 1.10 (BSF 962 2008-03-14)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Cc: freebsd-geom@freebsd.org
Subject: Re: Is geli detectable?
X-BeenThere: freebsd-geom@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: GEOM-specific discussions and implementations
	<freebsd-geom.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-geom>,
	<mailto:freebsd-geom-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-geom>
List-Post: <mailto:freebsd-geom@freebsd.org>
List-Help: <mailto:freebsd-geom-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-geom>,
	<mailto:freebsd-geom-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 19 Jun 2008 02:32:28 -0000

On Wed, 18 Jun 2008, RW wrote:

> Is it possible to tell the difference between a geli partition and a 
> partition filled with random data? Assuming that the geli partition was 
> prefilled from /dev/random before the "geli init".
>

All but the last sector will indeed appear to be more or less random data. 
But the last sector contains the geli metadata, and thus a distinction can 
be made.  You can prove this by running `geli dump <provider>` when the 
provider is not attached (decrypted), or by otherwise inspecting the last 
sector.

-- 
Greg Rivers