Skip to main content
Verify database operation, whole-tree encryption, and persistence across service and operating-system restarts.
File Explorer lock icons are convenience indicators only. They do not prove that every MariaDB file is protected.

Confirm the active data directory

1
Confirm MariaDB and the TDP services are running:
All three services report Running.
2
Query the effective data directory:Replace <admin> with a MariaDB administrative account. The command prompts for its password.
The query returns C:\MariaDBData\.

Perform a database round trip

Run the following SQL through a MariaDB client:
The query returns protected by CryptoHub TDP and a payload length of 1048576.

Verify every regular file

Run futurex-tdp-is-encrypted.exe against every file under the active data directory. The tool can write its Boolean result to a stream that some PowerShell versions classify as native-command error output, so use System.Diagnostics.Process instead of $LASTEXITCODE.
The scan reports clear=0 and indeterminate=0. Resolve every exception before treating the deployment as protected.

Verify restart and reboot persistence

1
Restart MariaDB:
MariaDB returns to Running.
2
Repeat the marker query and confirm the row is readable.
3
Restart Windows. Confirm MariaDB, Futurex-TDP-PKM, and FE2Policy return to Running.
4
Repeat the marker query, write another row, and rerun the whole-tree encryption scan.
The original marker remains readable, the new row succeeds, and the scan still reports clear=0 and indeterminate=0.
5
After every check passes, securely remove the temporary logical dump according to your organization’s data-handling policy.

Troubleshooting

  • Access is denied or MariaDB cannot open files: compare sc.exe qc MariaDB with the user on both path rules and the ACL on C:\MariaDBData. All three must name the same service identity.
  • The scan reports the entire tree as clear: confirm the PKM log contains both path rules and the assigned key group. Reinitialize and logically restore the destination only after policy is active.
  • Only manually created files are clear: identify the account that created them. An account absent from the path rule is expected to write clear files.
  • Old files remain clear after adding a rule: do not copy them into the protected directory. Restore a logical backup through the MariaDB service so the authorized identity rewrites them.
  • A policy change does not appear in the PKM log: restart Futurex-TDP-PKM, wait for the refreshed rules, and rerun verification before writing protected data.