Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 18 May 2024 17:10:32 +0000
From:      Anon Loli <anonloli@autistici.org>
To:        freebsd-hackers@freebsd.org
Subject:   [fixed] Re: GELI disk corrupted or external influence?
Message-ID:  <ZkjhCP-tmyBemT46@anonloli>
In-Reply-To: <ZkjePdUJqqrjjFsO@anonloli>
References:  <1716050202-69054-mlmmj-647e0ac8@FreeBSD.org> <ZkjePdUJqqrjjFsO@anonloli>

next in thread | previous in thread | raw e-mail | index | archive | help

Oh, I immediately tried this `geli restore /var/backups/ada0.eli ada0`
and it got fixed! :)

What broke this? Some BIOS setting change or the other OS deleted
something?
In any case I can finally move to OpenBSD lol bye (I'm still curious as
to who broke it, it's an older FreeBSD install if it matters)

On Sat, May 18, 2024 at 04:59:59PM +0000, Anon Loli wrote:
> Hello mailing list!
> I've had an event which includes modifying some BIOS settings (can't
> remember which exactly), and testing some OS other than FreeBSD.
> 
> And I think that the said OS did something malicious to the disk in
> question because it has been doing it for prolonged period of time, and
> mentioned disks..
> 
> So this was all on same machine, like dual-booting but from another
> drive.
> 
> Then when I went back into FreeBSD I noticed an error, `geli attach`
> doesn't work, I used a /etc/rc.local script for the GELI disk like so:
> `geli attach -p -k /etc/diskpassword.key /dev/ada0
> zpool import zmedia`
> I get an error message when I try to run the geli command:
> > geli: Cannot read metadata from /dev/ada0: Invalid argument.
> 
> I have /var/backupts/ada.eli if that can help..
> There's only /dev/ada0, no ada0s1 for example or .eli or whatever..
> Also when running `gpart show`, I see 2 disks:
> xxx GPT (main boot drive)
> freebsd-boot
> freebsd-swap
> freebsd-zfs
> 
> and
> ada0 GPT (the drive in problem)
> -free- (everything)
> 
> 
> Does this indicate that everything has been lost, like the partitioning
> table or whatever you call it, like it has been formatted?
> Did the other evil OS-fucker destroy my disk without saying it would do
> that?
> 
> 
> If you can't tell, I'm hesitant to give more information than what's
> necessary for someone to help me because almost any data can be used to
> deanonymize someone, but if you do need some information, please feel
> free to ask.
> 
> 
> TL;DR: some OS could have wiped some part of a FreeBSD-zfs drive, can
> you help me conclude wether or not we can somehow save it?



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?ZkjhCP-tmyBemT46>