csgather(1)						    BSD General Commands Manual 					       csgather(1)

NAME

     csgather -- Gather CoreStorage metadata for diagnosis

SYNOPSIS

     csgather -G dir device ...
     csgather -r mountPoint [-o filename]

DESCRIPTION

     csgather gathers CoreStorage metadata for diagnosis.  It works in two modes.

     In the first mode where -G and a list of devices are provided, CoreStorage metadata on these list of devices will be collected.  The col-
     lected information includes the size and UUID of the CoreStorage logical and physical volumes, the name of the logical volumes, the wrapped
     (encrypted) volume key (which can only be decrypted by a brute-force attack), user name and user login image file.  No other user information
     (such as directory structure, file names, file content, etc) is collected.

     In the second mode where -r is provided, the encryption context which includes the wrapped volume key (which can only be decrypted by a
     brute-force attack), user name and user login image file will be collected.

     If the wrapped volume key is decrypted by a brute-force attack, the volume key used to encrypt data on CoreStorage Logical Volumes is in the
     clear.  It is not mathematically possible to derive the user's passphrase from the volume key.  The volume key is only useful when the
     attacker has access to the encrypted data in the CoreStorage Logical Volume, which are not collected by csgather.

     The following options are available:

     -G dir	    Gather all CoreStorage metadata and write into the specified directory.  The given directory must not already exist.

     -o filename    Specify the output file generated by the -r option.  If not given, use standard output.

     -r mountPoint  Find out the CoreStorage logical volume identified by the given mount point, and print its encryption context to the file
		    given in the -o option.

SEE ALSO

     csdiagnose(1)

HISTORY

     The csgather utility first appeared along with CoreStorage in OS X 10.10.0.

OS X
								   May 31, 2019 							      OS X