Restore backup with Samsung SSD 250 EVO Encrypted Drive enabled

This will always be the case.  The reason being is once you are booted into  Windows, your drive is then no longer encrypted, or at least unlocked.  When Acronsi is backing up your machine, it is backing up the unencrypted state of the drive and hence, your image data is also unencrypted.

Acronis, and other applications, cannot backup your system when it is encrytped... if it could, this would defeat the purpose of having the encryption in the first place.  

So yes, Acronis can backup your drive when encryption is enabled, but only after Windows has been launched and the drive has technically been unlocked/decrypted already.  Acronis would not be able to take an offline image of the drive (using the recovery offline bootable media) why drive encryption is enabled as the drive will be encrypted and the data would not be readable by Acronis or any third party application in that state. 

Thank you for responding!

I understand. When restoring Windows it will always be not encrypted. So I have to encrypt it with Bitlocker again. That takes more than a hour.

Question: will TI 2016 restore a backup on a enabled Samsung Encrypted Drive or is it locked?

My ideas are:

1. use the Encrypted Drive enabled from Samsung Magician. TI 2016 will restore Windows and it will be not encrypted. Question is: because Samsung Encrypted Drive is enabled will encrypting with Bitlocker be quicker? Bitlocker hardware instead of software encrypted? That should be the advantage of enable Samsung Encrypted Drive.

2. a Microsoft tool (manage-bde) installed on the TI 2016 thumbdrive to open Bitlocker drive with the key and restore the backup on the open drive. After restoring and rebooting encryption is untouched.

What about those ideas?

I am not an expert here but hardware encryption relies on the key being stored on the hardware itself and the drive controller takes care of the encrytion tasks.  This is much different than software encryptions like bitlocker. 

If the drive is encrypted at pre-boot (between BIOS check and Windows load), you won't be able to modify the disk as it will be encrypted.  This is by design of the encryption since you don't want people to access your data - hence, Acronis won't be able to either. If the Samsung's have a pre-encryption password of some kind that you can enter at bios boot, then that would allow it to be unlocked and then you could image or restore, but again, it would be in an unlocked status at that point so I'm pretty sure if you restored you'd still have to encrypt again. I don't know of anyway around this - it's by encryption design to keep your data protected and the imaging is taking place only after the device has been unlocked/decrypted.

You can try to use the recovery WinPE media to backup the drive in sector by sector mode. This will make the backup file the same size as your SSD as all sectors including unused space will be backed up. Upon restore the encrytion will still be in place.

Bobbo is correct.  it is possible or at least should be possible to create a sector by sector backup of an encrypted disk and then use the boot media recovery to restore the disk.  This would only be possible when recovering to the same disk from which the backup was created.  This would not work if needing to restore to a new or different disk.

I've never tried the sector by sector backup of an encrypted drive, but I beleive Mustang is correct and it should work.  I have been able to use physical duplicators (kangaru enterprise dupliator) and physically copy one encrypted drive to another (as long as it was the same exact size) and they boot fine.  Hopefully, the sector by sector Acronis backup would work similarly.  The downside is you will be backing up the entire drive each time (say your data is only 100GB, but your drive is 500GB, your backup will be of the entire 500GB).  If space is not an issue, it saves time with the recovery not having to encrypt again, and it actually works, this should be a good alternative.  Give it a shot and let us know how it works.

Rivadi_NL wrote:

.....Question is: because Samsung Encrypted Drive is enabled will encrypting with Bitlocker be quicker? Bitlocker hardware instead of software encrypted? That should be the advantage of enable Samsung Encrypted Drive.

I believe that if you enable Samsung Encrypted Drive, Bitlocker is not required.  The entire disk will be encrypted.  Once the correct password is input during boot up, Samsung hardware will handle all encryption/decryption responsibilities.

With Samsung Encrypted Drive enabled, here's some of the things I would be interested in learning:

What happens if you take the system disk out and attach it via USB?  Is the BIOS smart enough to detect the encryption and ask for a password?

What happens when you boot from Acronis rescue media?  Does BIOS ask for the password during the boot sequence?

What happens if you enable Acronis Startup Recovery Manager (F11)?  Does the BIOS ask for the password before you get the F11 message?

Can you install a formatted, but otherwise empty disk in your computer and then reboot...Will BIOS give you the option to turn on Encryption?  If so, and you then performed a restore to that disk, I assume it would then be encrypted.

Personally, if I had the option between hardware encryption or software encryption, I would select hardware.

No matter what you decide, you should make & keep a validated full backup in a safe place.  Fully test your setup including a full restore.

Please keep us informed of how you proceed and what you learn in the process.  I know that I have more questions than answers, but I believe all can learn from your experiences.

Regards,

FtrPilot