diff --git a/MetadataCrypt.cpp b/MetadataCrypt.cpp
index acd5b59..76ea9eb 100644
--- a/MetadataCrypt.cpp
+++ b/MetadataCrypt.cpp
@@ -113,6 +113,23 @@
     LOG(INFO) << "Old Key deleted: " << dir;
 }
 
+static bool retrieveMetadataKey(bool create_if_absent, const std::string& key_path,
+                                const std::string& tmp_path, KeyBuffer* key, bool keepOld) {
+    if (pathExists(key_path)) {
+        LOG(DEBUG) << "Key exists, using: " << key_path;
+        if (!retrieveKey(key_path, kEmptyAuthentication, key, keepOld)) return false;
+    } else {
+        if (!create_if_absent) {
+            LOG(ERROR) << "No key found in " << key_path;
+            return false;
+        }
+        LOG(INFO) << "Creating new key in " << key_path;
+        if (!randomKey(key)) return false;
+        if (!storeKeyAtomically(key_path, tmp_path, kEmptyAuthentication, *key)) return false;
+    }
+    return true;
+}
+
 static bool read_key(const FstabEntry& data_rec, bool create_if_absent, KeyBuffer* key) {
     if (data_rec.metadata_key_dir.empty()) {
         LOG(ERROR) << "Failed to get metadata_key_dir";
@@ -143,9 +160,7 @@
             unlink(newKeyPath.c_str());
     }
     bool needs_cp = cp_needsCheckpoint();
-    if (!android::vold::retrieveKey(create_if_absent, kEmptyAuthentication, dir, temp, key,
-                                    needs_cp))
-        return false;
+    if (!retrieveMetadataKey(create_if_absent, dir, temp, key, needs_cp)) return false;
     if (needs_cp && pathExists(newKeyPath)) std::thread(commit_key, dir).detach();
     return true;
 }