manpagez: man pages & more
man csgather(1)
Home | html | info | man

csgather(1)               BSD General Commands Manual              csgather(1)


     csgather -- Gather CoreStorage metadata for diagnosis


     csgather -G dir device ...
     csgather -r mountPoint [-o filename]


     csgather gathers CoreStorage metadata for diagnosis.  It works in two

     In the first mode where -G and a list of devices are provided, CoreStor-
     age metadata on these list of devices will be collected.  The collected
     information includes the size and UUID of the CoreStorage logical and
     physical volumes, the name of the logical volumes, the wrapped
     (encrypted) volume key (which can only be decrypted by a brute-force
     attack), user name and user login image file.  No other user information
     (such as directory structure, file names, file content, etc) is col-

     In the second mode where -r is provided, the encryption context which
     includes the wrapped volume key (which can only be decrypted by a brute-
     force attack), user name and user login image file will be collected.

     If the wrapped volume key is decrypted by a brute-force attack, the vol-
     ume key used to encrypt data on CoreStorage Logical Volumes is in the
     clear.  It is not mathematically possible to derive the user's passphrase
     from the volume key.  The volume key is only useful when the attacker has
     access to the encrypted data in the CoreStorage Logical Volume, which are
     not collected by csgather.

     The following options are available:

     -G dir         Gather all CoreStorage metadata and write into the speci-
                    fied directory.  The given directory must not already

     -o filename    Specify the output file generated by the -r option.  If
                    not given, use standard output.

     -r mountPoint  Find out the CoreStorage logical volume identified by the
                    given mount point, and print its encryption context to the
                    file given in the -o option.




     The csgather utility first appeared along with CoreStorage in OS X

OS X                           January 28, 2017                           OS X

Mac OS X 10.11.6 - Generated Sat Jan 28 07:20:40 CST 2017
© 2000-2021
Individual documents may contain additional copyright information.