Possible to recover encryption key after newfs?

Luis P. Mendes luislupe at gmx.com
Mon Mar 14 00:05:18 UTC 2016


Hi,

A couple years ago, right when I was formatting a second hard drive to
serve as backup of the first, I accidentally made a `newfs` of the
/root slice of the first disk where the geli encryption key was stored
for the slice of the data compartment.

I ran several undelete softwares but could not find the file that had
a filename of ada0p8.key or something like that.  I don't remember
whether it was just a alphanumeric file or plain binary, perhaps with
128 bytes long, but not sure.  As such, the file has no signature, so
the recover process by undelete softwares was not possible by this
way.

I also tried to examine hex data, but since it's a big 2GB partition I
couldn't find the key file.

So, is there a way to be able to recover this file?  Some little
program to read byte by byte and seek for only alphanumeric characters
that are 128 bytes long? (if it's alphanumeric and if it's 128 bytes
long...)
Any other clues?


-- 


Luis Mendes


More information about the freebsd-fs mailing list