Recovering data from a directory server instance where encryption seed value is lost

Edit online

If an encryption seed value is lost for a directory server instance during an instance creation, then you cannot recover the lost encryption seed value. However, you can recover the data from the directory server instance for which the encryption seed value is lost.

The workaround is to create a directory server instance with a new encryption seed value and then use the db2ldif and ldif2db utilities to export and import data. You can supply the new encryption seed and salt value of the new instance to these utilities. The data would be preserved (along with the passwords) on this new instance. The steps to recover data on a Linux™ system are as follows:

Create a user for the instance. Issue the command of the following format:
```
idsadduser -u newinst -w newinst -l /home/newinst -g idsldap
```

Create and configure a new directory server instance. Issue the commands of the following format:

idsicrt -I newinst -e thisismynewencryptionseed -l /home/newinst -n
idscfgdb -I newinst -a newinst -w newinst -t newinst -l /home/newinst -n
idsdnpw -u cn=root -p root -I newinst
idscfgsuf -s "o=sample" -I newinst

Note: Save the encryption seed thisismynewencryptionseed.

After you set up the new instance, newinst, you must find and save the salt value that is generated by the directory server instance. To find the salt value, issue the command of the following format:
```
idsldapsearch -p port_number -D cn=root -w root -b "cn=crypto,cn=localhost" \
-s base objectclass=* ibm-slapdCryptoSalt
```
For example, consider the salt value of the new instance, newinst, as newsaltvalue.
To export data to an LDIF file from the directory server instance (for example, oldinst) for which the encryption seed is lost, use the db2ldif command of the following format:
```
db2ldif -o mydata.ldif -I oldinst -k thisismynewencryptionseed -t newsaltvalue
```
Note: After completion of this command successfully, the entire data from the directory server instance, oldinst, would be stored in the mydata.ldif file that is specified in the db2ldif command.
Finally, import the data from the LDIF file to the new directory server instance. Issue the ldif2db command of the following format:
```
ldif2db -i mydata.ldif -I newinst 
```