how ro recover encrypted slice

[Poul-Henning Kamp]

In message <20040405182852.GC567 at funkthat.com>, John-Mark Gurney writes:
>Poul-Henning Kamp wrote this message on Mon, Apr 05, 2004 at 09:21 +0200:
>> In message <c3421fc3355c.c3355cc3421f at nyroc.rr.com>, mmarkows at twcny.rr.com writ
>> es:
>> >I mounted a GEOM-encrypted slice to /home2 and stored all my data there. Two days ago, I decided to update my FreeBSD from 5.2 to 5.2.1. I have done it several times before, so I felt self-assured. I backed up my config files, forgetting unfortunately about /etc/gbde/ad1s2.
>> >
>> >During the update procedure my system was messed up to the extent that it seemed reasonable to do a clean install of 5.2.1. I did it without saving /etc/gbde/ad1s2, and without touching the encrypted slice.
>> >
>> >Now, I am in a predicament because I cannot access my files that I need for my work tomorrow. I know that I messed up, but my last backup is 3 weeks old, and essentially it is no good any more.
>> >
>> >Is there any way to recover the data? I have 13 hours to do it.
>> 
>> The data stored in the file you lost is only the encrypted location of
>> the master key, so in theory you could do a brute force search for the
>> master key.
>
>Doesn't this mean he can restore from his 3 week old backup of
>/etc/gbde/ad1s2, and then get back to bussiness?  I assume that his
>backup covered /etc...  and that /etc/gbde/ad1s2 doesn't change over
>time...

Provided you have not changed the password on your GBDE partition
in the meantime: yes, you can do that.

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
phk at FreeBSD.ORG         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.