On this page

SLAVE Vault Import & Restore

SLAVE dongles are read-only copies of a MASTER key. They share the same cryptographic key material and can decrypt any file that the MASTER encrypted. However, SLAVE dongles don't automatically know about vaults that the MASTER has created. The vault import workflow solves this by letting a SLAVE dongle discover and import vault configurations from encrypted metadata snapshots.

Understanding MASTER and SLAVE Roles

Capability MASTER SLAVE
Create vaults ✓ ✗
Add/remove locations ✓ ✗
Import files to vault ✓ ✗
Browse vault contents ✓ ✓
Decrypt/export files ✓ ✓
Run integrity check ✓ ✓
Import vault config ✗ ✓

SLAVE dongles are designed for recovery and read-only access — you can view and decrypt everything the MASTER created, but you can't modify vault structure.

How Vault Import Works

The Configuration Snapshot

Every vault location stores an encrypted configuration snapshot. This snapshot contains a compact copy of the vault configuration:

  • Vault name and settings
  • 2FA requirements
  • All configured storage locations

Snapshot Security

The snapshot file is encrypted and can only be read by dongles that share the same encryption key. This means:

  • Only your dongles (primary and backups) can decrypt the snapshot
  • The key identifier is verified against the connected dongle, preventing accidental import of vaults belonging to a different key
  • The snapshot is tamper-protected — any modification is detected and rejected

Snapshot Updates

The MASTER dongle best-effort writes the snapshot to every configured location whenever vault configuration changes:

  • Vault creation
  • Adding or deleting a location
  • Updating 2FA flags
  • Integrity repair operations that recreate nodes

This ensures that at least one location should have an up-to-date snapshot available for SLAVE import.

Import Workflow

Step 1 — Connect a SLAVE Dongle

Insert a SLAVE dongle (without a MASTER present). Necron Vault Manager detects the SLAVE role automatically.

When only a SLAVE dongle is connected, the sidebar Create / Import Vault button changes to Import Vault.

Step 2 — Select a Folder to Scan

Click Import Vault. An import modal appears asking you to select a folder.

Choose any folder that contains (or might contain) vault data — for example:

  • A cloud sync folder (e.g., your Dropbox folder)
  • A local backup drive
  • A folder you know contains .necron vault directories

The app scans recursively for vault configuration snapshots within the selected folder.

Step 3 — Review Discovered Vaults

The app attempts to decrypt each discovered snapshot using the SLAVE dongle's key. Only snapshots that:

  1. Successfully decrypt (matching key)
  2. Belong to the same key pair as the connected SLAVE dongle

…are shown as importable vaults.

The import modal previews:

  • Vault name — the human-readable name set by the MASTER
  • Storage locations — all configured locations from the snapshot

Note

If no matching vaults are found, the scan completed successfully but no compatible snapshots exist in the selected folder. Try scanning a different folder or check that the MASTER has created vaults with your key pair.

Step 4 — Import

Click Import to save the vault configuration to the SLAVE dongle. The vault now appears in the sidebar and can be opened for browsing and decryption.

After Import

Once imported, the vault behaves just like a MASTER vault — except all write operations are disabled:

  • Browse — the vault browser shows the full folder and file tree
  • Decrypt/export — select files and decrypt them to a local destination
  • Integrity check — run a read-only integrity verification across locations
  • No modifications — you cannot create folders, rename files, import new files, add locations, or delete anything

Tip

SLAVE import is ideal for disaster recovery scenarios. If your MASTER dongle is lost or damaged, your backup SLAVE dongle can still access all vault data by importing from any storage location that has a vault configuration snapshot.

Re-Importing After Changes

If the MASTER makes changes to the vault after the SLAVE has imported it (e.g., adds a new location, renames the vault, or changes 2FA settings), the SLAVE's imported configuration becomes stale. To update:

  1. Re-run the import workflow — scan the same folder
  2. The updated snapshot (refreshed by the MASTER) will be found
  3. Importing again overwrites the old vault config with the updated version

Troubleshooting

"No vaults found"

  • Ensure you're scanning a folder that contains vault directories
  • Check that the MASTER has created vaults using the same key pair as your SLAVE dongle
  • The snapshot files may not exist if the MASTER never performed a vault config update at that location

"Key mismatch"

  • The vault snapshot was created by a different key pair
  • Make sure your SLAVE dongle is paired with the correct MASTER

Vault appears empty after import

  • The vault's storage locations may be offline (cloud sync not running, drive not connected)
  • Check that the storage paths from the snapshot are accessible on your machine
  • Run an integrity check to see the status of all locations

Next Steps