Locked Pool - Is it really encrypted?

[penguinv22]

Hello,

About a year ago, before getting lost in the COVID response, I had a functioning FreeNAS system for home backup (mostly photos, videos and time machine backups). At some point my boot drive failed, and the system never came back up from a reboot. Now, I can't access my main pool, "tub"

I'm don't recall ever encrypting my data. I did use compression but remember thinking that encrypting the devices was a bad idea. I don't have any geli.key's saved and I don't have a passphrase saved in my password manager. However, as I've been troubleshooting, I keep on coming back to the conclusion that maybe the drives are encrypted which is I why I can't import the pool.

Based on other threads, I did the following troubleshooting. Does these data confirm that they are in-fact encrypted? I'm hoping not since I have a failed boot USB and no geli.keys or passphrase. Is it possible that there are zfs feature flags that 11.2-U8 still doesn't support that would be cause the pool to be "locked". Truthfully, I don't recall which version I was on when the system was working pre-pandemic meltdown.

Code:

root@mammoth:~ # camcontrol devlist<ATA HGST HDN724040AL A5E0>        at scbus0 target 0 lun 0 (da0,pass0)
<ATA HGST HDN724040AL A5E0>        at scbus0 target 1 lun 0 (da1,pass1)
<ATA HGST HDN724040AL A5E0>        at scbus0 target 2 lun 0 (da2,pass2)
<ATA HGST HDN724040AL A5E0>        at scbus0 target 3 lun 0 (da3,pass3)
<ATA HGST HDN724040AL A5E0>        at scbus0 target 4 lun 0 (da4,pass4)
<ATA HGST HDN724040AL A5E0>        at scbus0 target 5 lun 0 (da5,pass5)
<ATA ST4000DM000-1F21 CC54>        at scbus0 target 6 lun 0 (da6,pass6)
<ATA ST4000DM000-1F21 CC54>        at scbus0 target 7 lun 0 (da7,pass7)
<HL-DT-ST BD-RE  WH16NS40 1.02>    at scbus1 target 0 lun 0 (cd0,pass8)
<SanDisk Cruzer Fit 1.00>          at scbus8 target 0 lun 0 (da8,pass9)

root@mammoth:~ # sqlite3 /data/freenas-v1.db 'select * from storage_volume;'
1|tub|13221622326687284401|1|04370a26-ba4d-4e06-a258-6c8355f3e157

root@mammoth:~ # sqlite3 /data/freenas-v1.db 'select * from storage_encrypteddisk;'
1|1|gptid/f1cf691f-197b-11e6-a81e-0cc47aaba68c|{serial}      PK2334PEJBRXHT
1|2|gptid/f47cb65e-197b-11e6-a81e-0cc47aaba68c|{serial}      PK1334PEHZP64S
1|3|gptid/f741f471-197b-11e6-a81e-0cc47aaba68c|{serial}      PK1334PEJ4S7KS
1|4|gptid/f9e08047-197b-11e6-a81e-0cc47aaba68c|{serial}      PK1334PEJ4S7XS
1|5|gptid/fc6eb15e-197b-11e6-a81e-0cc47aaba68c|{serial}      PK1334PEJ15JXS
1|6|gptid/ff1780ca-197b-11e6-a81e-0cc47aaba68c|{serial}      PK1334PEJ1G76S

root@mammoth:~ # gpart show
=>        34  7814037101  da0  GPT  (3.6T)
          34          94       - free -  (47K)
         128     4194304    1  freebsd-swap  (2.0G)
     4194432  7809842696    2  freebsd-zfs  (3.6T)
  7814037128           7       - free -  (3.5K)

=>        34  7814037101  da1  GPT  (3.6T)
          34          94       - free -  (47K)
         128     4194304    1  freebsd-swap  (2.0G)
     4194432  7809842696    2  freebsd-zfs  (3.6T)
  7814037128           7       - free -  (3.5K)

=>        34  7814037101  da2  GPT  (3.6T)
          34          94       - free -  (47K)
         128     4194304    1  freebsd-swap  (2.0G)
     4194432  7809842696    2  freebsd-zfs  (3.6T)
  7814037128           7       - free -  (3.5K)

=>        34  7814037101  da3  GPT  (3.6T)
          34          94       - free -  (47K)
         128     4194304    1  freebsd-swap  (2.0G)
     4194432  7809842696    2  freebsd-zfs  (3.6T)
  7814037128           7       - free -  (3.5K)

=>        34  7814037101  da4  GPT  (3.6T)
          34          94       - free -  (47K)
         128     4194304    1  freebsd-swap  (2.0G)
     4194432  7809842696    2  freebsd-zfs  (3.6T)
  7814037128           7       - free -  (3.5K)

=>        34  7814037101  da5  GPT  (3.6T)
          34          94       - free -  (47K)
         128     4194304    1  freebsd-swap  (2.0G)
     4194432  7809842696    2  freebsd-zfs  (3.6T)
  7814037128           7       - free -  (3.5K)

=>        40  7814037088  da6  GPT  (3.6T)
          40          88       - free -  (44K)
         128     4194304    1  freebsd-swap  (2.0G)
     4194432  7809842688    2  freebsd-zfs  (3.6T)
  7814037120           8       - free -  (4.0K)

=>        40  7814037088  da7  GPT  (3.6T)
          40          88       - free -  (44K)
         128     4194304    1  freebsd-swap  (2.0G)
     4194432  7809842688    2  freebsd-zfs  (3.6T)
  7814037120           8       - free -  (4.0K)

=>      40  30842800  da8  GPT  (15G)
        40    204800    1  efi  (100M)
    204840  30637992    2  freebsd-zfs  (15G)
  30842832         8       - free -  (4.0K)

root@mammoth:~ # ls -1 /dev/gptid

a2b98043-5387-11eb-ab92-0cc47aaba68c
a9b2f147-ae4f-11e8-8529-0cc47aaba68c
aac491b0-ae4f-11e8-8529-0cc47aaba68c
f1cf691f-197b-11e6-a81e-0cc47aaba68c
f47cb65e-197b-11e6-a81e-0cc47aaba68c
f741f471-197b-11e6-a81e-0cc47aaba68c
f9e08047-197b-11e6-a81e-0cc47aaba68c
fc6eb15e-197b-11e6-a81e-0cc47aaba68c
ff1780ca-197b-11e6-a81e-0cc47aaba68c


root@mammoth:~ # zpool status
  pool: freenas-boot
 state: ONLINE
  scan: none requested
config:

        NAME        STATE     READ WRITE CKSUM
        freenas-boot  ONLINE       0     0     0
          da8p2     ONLINE       0     0     0

errors: No known data errors

This section of the freenas-debug file may also be relevant:

Code:

Configuring Disk Encryption for gptid/f1cf691f-197b-11e6-a81e-0cc47aaba68c.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 1 of 3.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 2 of 3.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 3 of 3.
Configuring Disk Encryption for gptid/f47cb65e-197b-11e6-a81e-0cc47aaba68c.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 1 of 3.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 2 of 3.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 3 of 3.
Configuring Disk Encryption for gptid/f741f471-197b-11e6-a81e-0cc47aaba68c.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 1 of 3.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 2 of 3.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 3 of 3.
Configuring Disk Encryption for gptid/f9e08047-197b-11e6-a81e-0cc47aaba68c.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 1 of 3.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 2 of 3.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 3 of 3.
Configuring Disk Encryption for gptid/fc6eb15e-197b-11e6-a81e-0cc47aaba68c.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 1 of 3.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 2 of 3.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 3 of 3.
Configuring Disk Encryption for gptid/ff1780ca-197b-11e6-a81e-0cc47aaba68c.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 1 of 3.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 2 of 3.
geli: Cannot open keyfile /data/geli/04370a26-ba4d-4e06-a258-6c8355f3e157.key: No such file or directory.
Attach failed; attempt 3 of 3.
Starting file system checks:
Mounting local filesystems:.
Beginning ZFS volume imports

    Importing 13221622326687284401

cannot import '13221622326687284401': no such pool available
    Importing tub

cannot import 'tub': no such pool available
cannot open 'tub': no such pool

ZFS volume imports complete

More of the long story... after encountering the failed boot device and letting the server sit for nearly a year, I attempted to build a new boot device but can't import my pool. On TrueNAS 12, it wouldn't even find it to import and the import of an old config file failed (something about afp and time machine). By creating a boot device with 11.0-Release and an old saved config for FreeNAS 11.0-Release, the pool was in my configuration but "locked". I thought that my pool may have zfs feature flags newer that it couldn't handle. So I attempted to install 11.3-U5. This didn't work. Newer versions (I tried several) failed on loading middleware on the update process and timed out or reverted with the /data/update.failed file noting an issue with afp and time machine in the older config file. Eventually, I was able to start with 11.0 again, remove the time machine shares, disable most services and then serially upgrade from 11.0 to 11.1-U7 and 11.2.-U8. Snipped from freenas-debug from the rebuilt and upgraded boot usb:

Code:

----------------------------------------------------------------------------+
+                zfs list -ro space,refer,mountpoint @1610354222                 +
+--------------------------------------------------------------------------------+
NAME                               AVAIL   USED  USEDSNAP  USEDDS  USEDREFRESERV  USEDCHILD  REFER  MOUNTPOINT
freenas-boot                       11.8G  2.21G         0     64K              0      2.21G    64K  none
freenas-boot/ROOT                  11.8G  2.19G         0     29K              0      2.19G    29K  none
freenas-boot/ROOT/11.1-U7          11.8G   777K         0    777K              0          0   741M  /
freenas-boot/ROOT/11.2-U8          11.8G  2.19G     1.45G    760M              0          0   760M  /
freenas-boot/ROOT/Initial-Install  11.8G     1K         0      1K              0          0   734M  legacy
freenas-boot/ROOT/default          11.8G   494K         0    494K              0          0   735M  legacy
freenas-boot/grub                  11.8G  7.17M         0   7.17M              0          0  7.17M  legacy
debug finished in 0 seconds for zfs list -ro space,refer,mountpoint

The system sees a "locked" pool called "tub". Again, I didn't THINK I encrypted the disks and don't have keys or a passphrase saved anywhere.

I have attached the entire freenas-debug -A.

The original boot device is was a PNY 32 GB USB drive (USB 3.0 I believe) with a USB-A connector on one side and a micro USB connector on the other side. If my pool is in fact encrypted, my hail mary might be to attempt to connect via the micro usb. I have an adapter coming but I'm not hopeful. Are there any tricks or commercial services for accessing sliver 4, where I understand the geli.keys are stored, on a boot device that is detected but can't be mounted?

Thanks in advance for your help.

 

[danb35]

All of that looks like your disks are encrypted. What's the output of zpool import?

 

[Chris Moore]

The system sees a "locked" pool called "tub". Again, I didn't THINK I encrypted the disks and don't have keys or a passphrase saved anywhere.

I concur with @danb35 , it appears that your pool was encrypted. This is bad news because the purpose of encryption is to keep the data safe from anyone without the key. It is extremely unlikely you will be able to access your data again, unless you can find the key / passphrase.