From owner-freebsd-geom@FreeBSD.ORG Mon Apr 5 11:38:21 2004 Return-Path: Delivered-To: freebsd-geom@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3175C16A4CE for ; Mon, 5 Apr 2004 11:38:21 -0700 (PDT) Received: from critter.freebsd.dk (critter.freebsd.dk [212.242.86.163]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8F66143D55 for ; Mon, 5 Apr 2004 11:38:20 -0700 (PDT) (envelope-from phk@phk.freebsd.dk) Received: from critter.freebsd.dk (localhost [127.0.0.1]) by critter.freebsd.dk (8.12.11/8.12.11) with ESMTP id i35IcEPW003551; Mon, 5 Apr 2004 20:38:14 +0200 (CEST) (envelope-from phk@phk.freebsd.dk) To: John-Mark Gurney From: "Poul-Henning Kamp" In-Reply-To: Your message of "Mon, 05 Apr 2004 11:28:52 PDT." <20040405182852.GC567@funkthat.com> Date: Mon, 05 Apr 2004 20:38:14 +0200 Message-ID: <3550.1081190294@critter.freebsd.dk> cc: mmarkows@twcny.rr.com cc: freebsd-geom@freebsd.org Subject: Re: how ro recover encrypted slice X-BeenThere: freebsd-geom@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: GEOM-specific discussions and implementations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Apr 2004 18:38:21 -0000 In message <20040405182852.GC567@funkthat.com>, John-Mark Gurney writes: >Poul-Henning Kamp wrote this message on Mon, Apr 05, 2004 at 09:21 +0200: >> In message , mmarkows@twcny.rr.com writ >> es: >> >I mounted a GEOM-encrypted slice to /home2 and stored all my data there. Two days ago, I decided to update my FreeBSD from 5.2 to 5.2.1. I have done it several times before, so I felt self-assured. I backed up my config files, forgetting unfortunately about /etc/gbde/ad1s2. >> > >> >During the update procedure my system was messed up to the extent that it seemed reasonable to do a clean install of 5.2.1. I did it without saving /etc/gbde/ad1s2, and without touching the encrypted slice. >> > >> >Now, I am in a predicament because I cannot access my files that I need for my work tomorrow. I know that I messed up, but my last backup is 3 weeks old, and essentially it is no good any more. >> > >> >Is there any way to recover the data? I have 13 hours to do it. >> >> The data stored in the file you lost is only the encrypted location of >> the master key, so in theory you could do a brute force search for the >> master key. > >Doesn't this mean he can restore from his 3 week old backup of >/etc/gbde/ad1s2, and then get back to bussiness? I assume that his >backup covered /etc... and that /etc/gbde/ad1s2 doesn't change over >time... Provided you have not changed the password on your GBDE partition in the meantime: yes, you can do that. -- Poul-Henning Kamp | UNIX since Zilog Zeus 3.20 phk@FreeBSD.ORG | TCP/IP since RFC 956 FreeBSD committer | BSD since 4.3-tahoe Never attribute to malice what can adequately be explained by incompetence.