Security - password vs encryption
One of the backups I perform is to an external HDD that is stored in a vehicle, so obviously security is required if theHDD is stolen. At the moment I only use a password to protect the backup but I know encryption is also possible. So 3 questions:
1. Is the password security safe assuming I use a good password? In other words, can the backup be opened in anyway without the password?
2. If encryption is used, is this reliable if the backup requires restoration? It would be a catastrophe if it would not decrypt.
3. How much longer does 128 bit encryption take to do, compared to zero encryption? I have 1TB of data that already takes a while.
Syd, I agree with you about the value of HDD encryption for external drives. I have two external USB HDDs that I use for file-based backups and True Image drive imaging.
These Western Digital drives offer entryption, unlocked by entering a password in a small Windows app that runs when the drive is connected. So, as Steve says, when running an ATI backup from within Windows, the .tib image can be written to the Western Digital drive since it was unlocked when I connected it and entered the password.
The downside is that when I do a drive or partition restore, after booting from the ATI bootable Rescue Media, there's no way to unlock the external drive. Western Digital doesn't offer a Linux version of their lock/unlock app. A few years ago another MVP and I experimented with using WinPE and including the Western Digital app in the WinPE build, but we couldn't get it to work. I haven[t tried for a few years, and perhaps WD have updated their app so that maybe there would be a way to get it to work with WinPE now, but without knowing that I'm not hopeful.
A workaround would be, prior to performing the restore, to connect the WD drive to a PC, unlock the drive and disable the encryption. Then the PC could be booted from the ATI bootable Rescue Media and the restore performed from the unlocked WD drive. Afterwards, the drive could be connected to Windows and encryption re-enabled. It's awkward, but it would work.
In this case, it seems like using an encrypted password on the backup would be sufficient? Acronis backups can be configured with 256-bit AES encryption via password when they are first setup (if your backup does not have this, you would need to start a new backup ask moving forward). Even if someone stole the drive and could access it, they're not going to get the acronis backup data from it with 256-bit AES password encryption on the backup files. Just be sure to use a stong password to make brute force attacks even harder, but with 256-bit encryption, it would be pretty tough anyway.
Also, I would not use the built in encryption of the drive since it is proprietary. If need be, use bitlocker. The same limitations of encrypted drives exist with recovery when teh disk is not connected to a booted OS. However, bitlocker support is available in WinPE. Our custom MVP tool provides the bitlocker winpe packages and as long as you have the bitlocker key, you can use command line unlock the drive (without fully decrypting it), in the WinPE Acronis recovery environment, should the need ever exist.
Links to the MVP builder and Windows ADK are down below if you decide to go this route. Make sure to test and give it a try before committing to it though if you do go the bitlocker route.
Thanks for the advice everyone. Some of the data in the backup is very important/critical so I am very wary about using any encryption system that may cause problems with a potential permanent locking of the data. That is the reason to date that I have just used a strong password which, as Steve suggests, should be OK but nowadays I get quite paranoid about security. I know there are drive encryption systems available, I did look at bitlocker, but to keep things simple and hopefully effective, I was considering just using the ATI encryption.
Thanks for your assistance. It is very much appreciated.
Syd, I would recommend using physical security in addiition to any password protection for the drive being kept in your vehicle. I have a car safe in my vehicle which is anchored in the boot (trunk for our US cousins) and would fit a standard hard drive.
I recommend a trunk monkey for physical security in your vehicle.