ATI2021 Backups from Bitlocker not accessible from ISO bootable USB drive
So I have been using ATI2021 on multiple machines W10x64Pro 2004/20H2 Mar update and earlier. I wanted to replace a drive with a larger one. I boot with the ISO from the product page and attempt to restore and it asks to reboot and get an error message with the c:\jenkins_agent in it. Tried the track zero first and just the others but nothing works.
So, I tried to use the same bootable ISO to do a total drive backup to tibx but get error messages it's Bitlocker encrypted and to unlock drive or remove Bitlocker. Drive is unlocked (open padlock). No option to lock/unlock.
OK - make a bootable recovery ISO from ATI2021 on the Bitlocker encrypted PC. I create a bootable USB with thesimple this machine ISO - it finds the tibx's on the external HDD. I select one. Go thru all the steps and try to put it on another USB drive to provide a duplicate. I get the same reboot error as above so the create a simple recovery drive for the same machine fails.
OK, take Bitlocker off and backup using both ATI2021 from Windows and then from a USB bootable ISO - two backups on external drive. I use ATI's 256bit encryption.
Booting from the ISO bootable USB I can restore either. I get asked for the PW and it restores to another USB or HDD/SSD perfectly.
How is one supposed to restore the backups created with the Bitlocker encrypted ATI2021 to a new drive? Often I have to restore older tibx's for various reasons to drives to obtain files or software plus to create bootable USB drives as backup in case the HDD/SSD dies. They might be slower but one can retrieve a complete bootable USB version of the existing Windows 10 HDD/SSD. If the Bitlocker Key changes each time I decrypt and reencrypt how can I access those previous tibx's?
This problem wasn't evident in 11.5-11.7.
Steve Smith wrote:Anthony, several comments here:
- None of the Linux based ISO media for ATI has any support for BitLocker!
- When you create a Disk backup of an encrypted BitLocker drive from the Windows ATI application, this is only possible if that drive is unlocked, and the resulting backup image is not BitLocker encrypted!
- If you want to work with BitLocker drives (Source or Destination) from Acronis rescue media, then you need to create the 'Simple' version of WinRE media from a system with Windows 10 Pro to enable BitLocker support in the rescue environment, but then you need to unlock the encrypted drive(s) before relaunching the ATI offline application.
Number 1 doesn't work - tried all the options making a rescue drive - Winpe, iso,
Number 2 doesn't work. I have many ATI2021 backed up images from an unlocked drive that will not restore.
Number 3 doesn't work - I did that trying multiple tibxs.Same error regardless of what I try. All backups from same machine.
Anthony, the Number 1 point was that the Linux based rescue media does not have any BitLocker support, so no surprise that it doesn't work if you are attempting to use in with drives that are encrypted!.
For Number 2, if you have created images of an unlocked drive, then these should be capable of being restored to any destination drive providing it is either not encrypted or has been unlocked before starting the restore.
If you are seeing an error 'Attempt to use null reference' when doing the recovery, then more information is needed to understand why that error is being thrown?
Are you restoring an image as per Number 2, i.e. of an unlocked drive?
What are you attempting to recover that image to? Is the target drive encrypted and unlocked?
See the following that I captured when dealing with another user regarding BitLocker and rescue media recently:
If you create the 'Simple' version of the ATI 2021 rescue media, and do this on Windows 10 Pro which has BitLocker support, then this is included in the rescue media but there are some steps that are needed in order to access a BitLocker encrypted drive in the rescue environment.
When you boot into the rescue environment, you will see a black Command prompt window along with the main ATI 2021 application window. You need to close the ATI 2021 window in order to have access to the command prompt in the black window.
Now, you can use the BitLocker commands to identify and unlock your encrypted drive before relaunching the ATI 2021 application again using "X:\Program Files\Acronis\TrueImageHome\trueimage_starter.exe"
See the following data captured from my own system booted from the ATI 2021 Simple rescue media with an encrypted drive connected.
X:\windows\system32>wpeinit
X:\windows\system32>"X:\Program Files\Acronis\TrueImageHome\trueimage_starter.exe"
Terminate batch job (Y/N)? nX:\windows\system32>manage-bde -status
BitLocker Drive Encryption: Configuration Tool version 10.0.19041
Copyright (C) 2013 Microsoft Corporation. All rights reserved.Disk volumes that can be protected with
BitLocker Drive Encryption:
Volume C: [Windows]
[Data Volume]Size: 200.83 GB
BitLocker Version: None
Conversion Status: Fully Decrypted
Percentage Encrypted: 0.0%
Encryption Method: None
Protection Status: Protection Off
Lock Status: Unlocked
Identification Field: None
Automatic Unlock: Disabled
Key Protectors: None FoundVolume D: [SSD-Data]
[Data Volume]Size: 263.29 GB
BitLocker Version: None
Conversion Status: Fully Decrypted
Percentage Encrypted: 0.0%
Encryption Method: None
Protection Status: Protection Off
Lock Status: Unlocked
Identification Field: None
Automatic Unlock: Disabled
Key Protectors: None FoundVolume L: [Label Unknown]
[Data Volume]
Size: Unknown GB
BitLocker Version: 2.0
Conversion Status: Unknown
Percentage Encrypted: Unknown%
Encryption Method: AES 128
Protection Status: Unknown
Lock Status: Locked
Identification Field: Unknown
Automatic Unlock: Disabled
Key Protectors:
Password
Numerical PasswordVolume H: [Data]
[Data Volume]Size: 114.10 GB
BitLocker Version: None
Conversion Status: Fully Decrypted
Percentage Encrypted: 0.0%
Encryption Method: None
Protection Status: Protection Off
Lock Status: Unlocked
Identification Field: None
Automatic Unlock: Disabled
Key Protectors: None FoundX:\windows\system32>manage-bde -unlock L: -password
BitLocker Drive Encryption: Configuration Tool version 10.0.19041
Copyright (C) 2013 Microsoft Corporation. All rights reserved.Enter the password to unlock this volume:
The password successfully unlocked volume L:.X:\windows\system32>dir L:
Volume in drive L is Seagate250gb
Volume Serial Number is 1052-D550Directory of L:\
07/11/2020 00:08 46,379,683,840 MyBackup(1).tibx
05/11/2020 00:51 45,030,981,632 MyBackup.tibx
2 File(s) 91,410,665,472 bytes
0 Dir(s) 158,538,076,160 bytes freeX:\windows\system32>"X:\Program Files\Acronis\TrueImageHome\trueimage_starter.exe"
X:\windows\system32>
My PC has a 512GB M.2 and is bitlocker encrypted and locked. That's fine as I am not accessing it at all.
I have a 1TB SSD USB 3.2 attached to a Thunderbolt port. Fully decrypted and unlocked. On that drive are many tibx's from that PC M.2 above which was Bitlocker encrypted. The drive copied to was NOT Bitlocker encrypted. They are also Acronis 256bit encrypted.
I have a brand new USB 256GB drive in a USB port.
I created the Simple WinPE from the rescue menues.
It boots fine and I can get to the CMD.
The new USB drive does not show (tried unformatted, GPT, and MBR) in the CMD but does show when Acronis tries to use as a target to restore to.
If I run the GUI I get the same error - reboot and Jenkins.
I want to restore the tibx on the external USB mounted SSD to the new USB flash drive (not the c: on the PC). Unencrypted works fine. There tibx's were done from the same PC last year. I just want to restore the entire drive to the flash drive so I can boot from the flash drive and have an exact copy of the PC not using the C: internal M.2.
This works file with any non-Bitlocker backup. It's the ones that I previously did that will not restore and give the error.
I have a brand new USB 256GB drive in a USB port.
I created the Simple WinPE from the rescue menues.
It boots fine and I can get to the CMD.
The new USB drive does not show (tried unformatted, GPT, and MBR) in the CMD but does show when Acronis tries to use as a target to restore to.
For the brand new USB 256GB USB drive, have you tried using the Tools > Add new disk option to prepare this drive as GPT partition scheme but leaving it as uninitialised? Doing this should allow the drive to show correctly.
I just want to restore the entire drive to the flash drive so I can boot from the flash drive and have an exact copy of the PC not using the C: internal M.2.
Microsoft do not normally allow Windows to be booted from any external USB drive unless you have used the Enterprise Windows to Go or equivalent feature to create a bootable drive.
Steve Smith wrote:I have a brand new USB 256GB drive in a USB port.
I created the Simple WinPE from the rescue menues.
It boots fine and I can get to the CMD.
The new USB drive does not show (tried unformatted, GPT, and MBR) in the CMD but does show when Acronis tries to use as a target to restore to.
For the brand new USB 256GB USB drive, have you tried using the Tools > Add new disk option to prepare this drive as GPT partition scheme but leaving it as uninitialised? Doing this should allow the drive to show correctly.
Tried it and does no good. Usually use mini-partition and initialize to GPT.
I just want to restore the entire drive to the flash drive so I can boot from the flash drive and have an exact copy of the PC not using the C: internal M.2.
Microsoft do not normally allow Windows to be booted from any external USB drive unless you have used the Enterprise Windows to Go or equivalent feature to create a bootable drive.
If you boot from the USB it becomes the C drive. Since it's on the same machine is looks like just a hard drive change. Authenticates fine.
When I'm on the road and it can be months, I carry bootable Windows and Linux on flash drives in the event something breaks. The inability to restore Bitlocker backed-up drives means I have to de-bitlocker, backup, and re-bitlocker each time. That is unacceptable. If something goes haywire I have a UEFI Mini-Partition to blow away the C -drive and restore from the bootable USB drive. However, the Bitlocker tibx's from the original Windows PC will not restore. Acronis should look into this.
Anthony,
In post number 5 you say
"I have a 1TB SSD USB 3.2 attached to a Thunderbolt port. Fully decrypted and unlocked. On that drive are many tibx's from that PC M.2 above which was Bitlocker encrypted. The drive copied to was NOT Bitlocker encrypted. They are also Acronis 256bit encrypted."
Did you copy a few tibx files from a backup chain and then try to restore them? If so all files in a backup chain are dependent upon each other and all fikles of the chain must be present in the same location or else the recovery will fail.
Enchantech wrote:Anthony,
In post number 5 you say
"I have a 1TB SSD USB 3.2 attached to a Thunderbolt port. Fully decrypted and unlocked. On that drive are many tibx's from that PC M.2 above which was Bitlocker encrypted. The drive copied to was NOT Bitlocker encrypted. They are also Acronis 256bit encrypted."
Did you copy a few tibx files from a backup chain and then try to restore them? If so all files in a backup chain are dependent upon each other and all fikles of the chain must be present in the same location or else the recovery will fail.
No - All are single full backups done from the machine directly to the external USB drive. I have two drives per machine and none will restore for any of three machines.I have also tried a fresh external drive with nothing on it. Did a backup and tried to restore - nada - same error with the null reference. If I remove Bitlocker backup and restore works fine. If I leave Bitlocker on, backup works but the restores will not.
No - All are single full backups done from the machine directly to the external USB drive. I have two drives per machine and none will restore for any of three machines.I have also tried a fresh external drive with nothing on it. Did a backup and tried to restore - nada - same error with the null reference. If I remove Bitlocker backup and restore works fine. If I leave Bitlocker on, backup works but the restores will not.
How were these single full backups done? Was this from the Windows ATI app, and if so, was the same task used to create more than a single full backup?
Is the target drive for the restore still encrypted when starting the restore?
Steve Smith wrote:No - All are single full backups done from the machine directly to the external USB drive. I have two drives per machine and none will restore for any of three machines.I have also tried a fresh external drive with nothing on it. Did a backup and tried to restore - nada - same error with the null reference. If I remove Bitlocker backup and restore works fine. If I leave Bitlocker on, backup works but the restores will not.
How were these single full backups done? Was this from the Windows ATI app, and if so, was the same task used to create more than a single full backup?
** From ATI2021 latest update from Windows. I create new full backups with different names (dag13-2021-mar-full, dag13-2021-feb-full et al) and use ATI256bit encryption.
Is the target drive for the restore still encrypted when starting the restore?
Target drive is a new either USB flash drive or a usb HDD/SSD. None are encrypted. Used ATI to add drive as well. Also used Mini-Partition to try both MBR and GPT. Backing up to the external USB HDD/SSD works fine. Just cannot restore. Also when I attempt to restore I am never asked for the ATI encryption password. I am when I do a non-Bitlocker backup and restore. For the restore I have now tried every option ATI has for creating a rescue disk but all get the same error requiring a restart and details state the c:\jenkins error. I have tried a fresh external HDD with nothing else on it (GPT and NTFS) to do the full backup from the PC that is Bitlockered. Only the one tibx exists on the drive. Again, trying to restore gives the same error. Picture is of external USB drive I am backing up to.
Anthony, if you are creating these full backups using the Windows ATI 2021 application, then there should be no difference between these and having BitLocker encryption but unlocked, assuming that it is only the C: OS partition that is encrypted.
As you are restoring to an external USB drive that has been prepared as GPT, then have you tried doing the restore from the Windows ATI application?
In reading through this i think your issue is related to the fact that you have two forms of encryption in play here, they are Acronis own 256 bit encryption and Bitlocker. It is a mystery to me why you are applying both forms of encryption to these backups. It serves no purpose and in fact introduces the issues you have here.
I suggest you pick one form or the other to use and stick with that but do not use both. The Acronis encryption will achieve your objective of not having to unlock the encryption at times when you desire not to and offers a fool proof way of being asked for password when the application deems it necessary to work with a backup. I get that this does not apply to the disk itself and Bitlocker takes care of that for you here. So if that is the issue for you, that your laptop disk you deem necessary to have encrypted, than use Bitlocker for that. Yes, you have to turn it off to work with TI and your backups but I fail to see the issue with that personally.
Enchantech wrote:In reading through this i think your issue is related to the fact that you have two forms of encryption in play here, they are Acronis own 256 bit encryption and Bitlocker. It is a mystery to me why you are applying both forms of encryption to these backups. It serves no purpose and in fact introduces the issues you have here.
I suggest you pick one form or the other to use and stick with that but do not use both. The Acronis encryption will achieve your objective of not having to unlock the encryption at times when you desire not to and offers a fool proof way of being asked for password when the application deems it necessary to work with a backup. I get that this does not apply to the disk itself and Bitlocker takes care of that for you here. So if that is the issue for you, that your laptop disk you deem necessary to have encrypted, than use Bitlocker for that. Yes, you have to turn it off to work with TI and your backups but I fail to see the issue with that personally.
Just tried it without the ATI encryption and got the same error on restore so the theory that the two are bumping heads is not the issue. Ironically with 11.5 on another machine that has Bitlocker running, I can use the Windows ATI 11.5 to backup with an ATI password and restore it without having to uninstall Bitlocker before backing up. I am aware that the Bitlocker is stripped off when backing up, hence the ATI password. After I restore I can re-Bitlocker as needed - but I just generally want to get a few files.
Uninstalling Bitlocker before backing up is time consuming, especially when I'm dealing with 1 thru 10TB drives. I would rather just backup and if I need to re-invoke Bitlocker, I can at my convenience.
I wouldn't have this problem if 11.5 could read M.2 drives. Just saying...
c: drive is unlocked. I wonder if it's something to do with an M.2 SSD?
Anthony,
Tell you what, I have read your plea about if only 11.5 or 11.7 could see my M.2 well, how about I show you a way to do just that.
Please review the link below that describes how you can install the Windows ADK on your machine then use the builtin media builder tool in Acronis Backup (11.5 or 11.7) to build WinPE media and along the way add drivers for your storage controller so that the media will see your M.2 disk. This may be the answer you've been looking for:
https://kb.acronis.com/content/24254
I added the drivers and created the 11.7 PE bootable. Booting from it the 11.7 recognizes and backs up the M.2 which is great - except - I cannot restore it. It does not recognize the format of the C: NTFS drive and will not restore it. It does the other two partitions. I have tried multiple drives that are USB attached - 1TB Toshiba and 640GB Seagate. Both were initialized as GPT (which is what the M.2 is). The 11.7 backed up TIB validates OK.
Disk1 is the c: M.2 on the computer. 11.7 is not recognizing the NTFS partition as NTFS. The C drive is Bitlockered but unlocked.
Disk 3 contains the TIBs.
Disk 4 is the target and when it failed to restore I manually created the partitions and tried to force each partition from Disk 1 into it. No dice.
Is there some type of driver that needs to be included for Bitlocker? I've added all the drivers I could download from the Acer site for any storage or Intel product.
So now your issue is that Acronis products still adhere to the old MS policy of booting from removable media being prohibited. A move away from that by MS has happened with the release of version 1706 of Windows 10 I believe however, Acronis has not followed suit at this point in time. You would need to plead your case to Acronis Support at this point. It is possible that the next release of the product may bring such support, time will tell. Alternatively, you can possibly restore to a disk attached internally in a PC and then use that disk to boot as you desire.
I can do a non-Bitlocker backup and restore even with ATI2021. Doing a backup with the 11.7 and drivers on a non-Bitlocker drive works and is listed as NTFS. Using the 11.7 PE bootable backup, the Bitlocker backup from the M.2 doesn't show the c: partition as NTFS. Whatever it is has to do with Bitlocker and the M.2.
I have machines with 11.5 loaded and it will do a backup and restore fine but they are 2.5 inch SSDs. Bitlocker and Acronis encryption work together. Backing up strips off the Bitlocker and Acronis encryption protects the data. Restore works fine from the downloaded ISO bootable USB. I can also restore to a USB drive and make it bootable with no problem. If needed, I reapply Bitlocker to the internal SSD/HDD..
Okay, I get it. Do you have any settings in your bios that may be in play here? I have never seen or heard of this but is your M.2 drive self encrypting? There most certainly has to be an issue here that's for certain. This is at the point though were the logical and known possibilities have been exhausted so the road now leads to Acronis Support.
Bob, good point about hardware encryption of the M.2 drive; I am aware that some do support hardware encryption but none of my Samsung drive do as far as I am aware.
Ian
I have not seen any mention of Self Encrypting NVMe M.2 type drives when I have been looking at these, and where SED has been mentioned has mainly related to more traditional SSD or HDD 2.5" drives.
SO another quirk happened. After the failure of Acronis to recover an M.2 Bitlocker backup I started playing around. I have another laptop with an Optane 512GB M.2 SSD. I experienced the same problems with Bitlocker backups. I then did an 11.7, ATI2020, and ATI2021 backups from the other machine. They all backed up fine but the restores would not work. I decrypted the drive (yes they were unlocked for the backups). I did an ATI2020 backup of the unencrypted drive and restored it. It wouldn't boot even though I recovered the MBR. I remembered the internal drive was and Optane so I attempted to use Mini-Partition to unraid it but it would not recognize the drive. I booted from my Fedora Linux drive and used Gparted and it found the drive and I was able to delete everything on it (destroyed the Optane RAID) and initialize as a GPT with no partitions. I restored the Bitlocker unencrypted (but it had ATI encryption 256bit on i and prompted for pw) and it restored OK. I then had to go into the Optane Intel software and re-pair the two partitions and all is working well again. I had this trouble a while back with the Optane drives and put a solution out there on the 2020 forum. I think Acronis needs to do a bit of work to make the backup and restore of a Bitlocker encrypted drive actually work. I would have thought it would be easy because it worked with 11.5 perfectly. I really hate to leave the machines unencrypted in case they are stolen (we travel a lot) to use the Acronis backup without Bitlocker. I still have a machine that will backup a Bitlocker encrypted drive that I use ATI encryption when backing up. It strips off the Bitlocker encryption but retains the ATI encryption, and I can restore this to any drive I want using the ATI pw - internal or external USB. Yes, I had the Intel drivers loaded to the ATI 11.7 bootable restore USB drive.