Restoring an Older Checkpoint Before ALTER PASSPHRASE WITH NEWKEY
The following precautions are necessary to restore and rollforward from an old checkpoint that was done before changing the passphrase and main key with ALTER PASSPHRASE WITH NEWKEY.
The command "rollforwarddb", used to restore a checkpoint and roll forward transactions, depends on information in the database config file named "aaaaaaaa.cnf". This file is in the DATABASE location of the database and a copy of it may exist in the DUMP location. ALTER PASSPHRASE WITH NEWKEY updates encryption information in this file in both locations. However, to restore from an old checkpoint, taken before the passphrase change, the old encryption information is needed. As it is not possible to rollforward the passphrase change itself and beyond it, a rollforward from such an old checkpoint also must be restricted to stop before the passphrase change happened. Therefore, the following preparations are important before changing the passphrase so that you can later restore and roll forward from checkpoints created before the passphrase change.
Before changing the passphrase WITH NEWKEY do the following:
• Note down and remember the current date and time (wall clock time).
• This will be needed to stop a rollforward from a previous checkpoint before it reaches the following passphrase change.
• Remember the old passphrase (i.e. the current passphrase before changing it).
• Save a copy of the current database config file, as it contains the encryption information that corresponds to the previous checkpoint.
• If the database is journalled, then advance to the next journal file by running the command:
alterdb -next_jnl_file <dbname>
• Finally, change the passphrase WITH NEWKEY and perform a new checkpoint.
To restore an old checkpoint before a passphrase change do the following:
• Convert the remembered date-time (noted down before the passphrase was changed to California time (time zone PST).
• Save a copy of the current database config file.
• Restore the old copy of the database config file (copied before the passphrase was changed) that corresponds to the checkpoint into the DATABASE location.
• Unlock the database with the old passphrase by connecting to iidbdb and run the SQL statement:
ENABLE PASSPHRASE <old passphrase> ON DATABASE <dbname>;
• To restore the old checkpoint using the "rollforwarddb" command specify the following:
• the checkpoint sequence number as identifier for the desired checkpoint,
• the roll forward end time (as California, PST time):
rollforwarddb +c '#c<ckp number>' -eDD-MMM-YYYY:hh:mm:ss <dbname>
Example:
To restore the checkpoint with sequence number 4 and stop the roll forward at 5:28:13 pm on16th December 2025 (California time, PST), run the following command:
rollforwarddb +c '#c4' -e16-Dec-2025:17:28:13 <dbname>
It is recommended to exercise the whole procedure, including the preparation steps as suggested in the section Before changing the passphrase WITH NEWKEY, on a test system to be sure that it can be successfully performed in case of a real situation needing the restore of an old checkpoint.
Last modified date: 09/11/2026