If the user forgets their password to generate the encryption key, do they therefore lose all of their files? Is there anything to stop an attacker getting the

If the user forgets their password to generate the encryption key, do they therefore lose all of their files? Is there anything to stop an attacker getting the config file and just running a dictionary attack?