This is old post but I am running into same issue with the DEK-info section of the fortinet and can't figure out the regex to make the multiple line match work. The provided "correct answer" doesn't work and it is causing this backup to flag as changed every time I perform my scheduled backup job.
Any help would be great.