Backing Up Encrypted Volumes
Hello,
When backing up an encrypted volume, do I need to suspend encryption on the source or destination drive, or both?
Thank you.
"Install Acronis True Image on your computer and configure a backup task to back up encrypted disks. You need to unlock the disk (use Suspend protection option for that) before backing up. You cannot back up encrypted disks in Acronis bootable media."
The disk that needs to be suspended is gray, are they referring to the source or destination?
Which drive is encrypted or are both the source and destination drives encrypted in this scenario?
Typically, if you are using say BitLocker encryption on an active Windows OS, then that encryption is transparent to the OS and any applications running with it, such as Acronis True Image, so the net effect is that ATI can backup that source OS drive without any additional actions being needed to suspend encryption but the backup image created will not be encrypted.
If you have an encrypted destination drive, then how is this shown in say Windows Explorer? If it is locked by encryption until such time as you unlock / suspend encryption to allow access, then the same will apply to ATI too, and it too will be unable to write to that drive unless it is made accessible to the application.
I'm a little confused here. Both the source and destination drives are locked and encrypted with BitLocker.
What is the best method for me to backup an encrypted drive so if someone steals my hard drive with either the source or destination, they will not be able to use it, but I can restore it successfully?
Acronis True Image includes its own encryption for backup files that you can use to securely protect your backup when you make these from within the running Windows ATI program.
As I said earlier, backups of encrypted volumes made by ATI running in Windows will not be encrypted with BitLocker therefore you would need to secure them as part of the backup operation using the options provided by ATI.
Provided that your backup destination drive is unlocked while booted into Windows to allow Acronis to write the backup to that drive, then effectively your backup image would be encrypted twice, once by Acronis and again when you lock the drive by BitLocker.
If someone does steal either of these drives, then providing that they don't actually steal your whole computer and cannot simply boot into Windows to unlock the drives, then the drives themselves would still be encrypted by BitLocker.
So if C drive is encrypted by BitLocker and I use ATI to back it up to the H drive which is also encrypted by BitLocker, I need to only unlock my H drive before backing up and can leave the C drive BitLocker Encrypted during the encryption?
I understand that ATI encrypts, but leave that out of the question here.
Then when I restore, the C drive would be BitLocker encrypted.
Let me ask a different question here: when your Windows is booted, are both your C: and H: drives 'open' in terms that you can browse their contents via Explorer, and can ATI see the contents? If yes, then ATI should be able to backup your C: drive to your H: drive.
Note: the backup created by ATI will not be BitLocker encrypted so will need to be protected by using the ATI password encryption option, as if ATI can access your files to back them up, then so could malware if it was active on the same computer!
I can see the drives freely.
Does ATI disable BitLocker?
No, ATI knows nothing about BitLocker or else it would give you a warning that the drive is encrypted. The drive just looks to be unencrypted to ATI which allows it to do the backup, and that backup will not be encrypted by BitLocker either for the same reason.
Ok, so the drive is encrypted with bitlocker, when I turn the PC on it gets unlocked via tpm or pin. So technically with bitlocker in my case it is for when my PC is off which is when the drive is locked?
Since the drive is unlocked at the time of booking, ATI does not sense that it is encrypted?
When I were to restore the image, the destination drive needs to be unlocked so ATI can see the data?
Yes, BitLocker is essentially providing protection when the PC is powered off, so protection against theft etc.
The key issue with storing your Acronis backup .TIB files on your BitLocker encrypted drive is the need to be able to unlock or decrypt that drive in the event of needing to recover from that backup, something which the default Acronis Rescue Media does not have support for doing, so you would need another way of unlocking the drive to make it accessible.