Restore image backup to Microsoft eDrive (Bitlocker hardware encryption)
Hi!
I'm using a Samsung SSD 840 Evo in eDrive mode (Bitlocker hardware encryption, UEFI Secure Boot, Windows 10 Pro).
This seems to be a real problem when you want to restore an image backup. I can easily create an image when I'm in Windows 10 and the eDrive is unlocked. The content of the image is unencrypted because in it's unlocked state the eDrive can be handled like an unencrypted drive.
The problem now is how to restore the backup. With Bitlocker software encryption you can just boot from the Acronis rescue media, kill the Bitlocker partition and overwrite it with the unencrypted content from the backup. After that you can just boot into Windows and reenable Bitlocker to encrypt everything again.
But in eDrive mode (Bitlocker hardware encryption) the encrypted partition is locked and the SSD doesn't allow any read/write action until proper authentication.
I tried booting from the Acronis rescue media but it gave me tons of error messages because the SSD is unreadable. If I ignore them, the whole SSD looks as if is uninitialized and every try to restore a backup on it fails. I can only see the partition with Bitlocker software encryption on my second HDD which is correctly marked as "BitLocker" and can be overwritten with unencrypted data.
So I looked into some Microsoft Technet articles on how to deploy an image to an encrypted eDrive. They say it is possible by booting into an slightly modified WinPE (with Bitlocker components added), where you can unlock the eDrive. (like it is described here by Mustang: https://forum.acronis.com/forum/84464)
According to Microsoft you can just write an image to the drive after unlocking it. So my idea is to create a WinPE with TI 2016, add the necessary Bitlocker components, boot from it and unlock the eDrive with the corresponding Bitlocker command, and then restore an image of the C: partition created by TI 2016.
Because it's hardware encryption it shouldn't be different for TI whether I'm restoring something to an unlocked eDrive or to a not encrypted drive.
When I understand it correctly, an eDrive should behave like a drive protected by an ATA security password. Once it's unlocked, it can be treated like every other drive.
Will this work? Or am I wrong?

- Log in to post comments

Ok, looks like I don't need help with that anymore, it worked! :)
Unlocked the drive with "manage-bde" in WinPE, restored the partition with TI, reboot. Bitlocker/encryption was not broken and was still active with the same encryption keys when I was back in Windows. According to PowerShell, the drive is still fully encrypted.
This won't work with Bitlocker software encryption because there you actually kill the whole encryption and Bitlocker information by overwriting it with an unencrypted backup.
But with the eDrive, everything encryption-related is stored in the SSD controller, so overwriting/changing partitions won't hurt.
- Log in to post comments

Thanks for posting your experience Martin, I am certain others will find it most helpful.
- Log in to post comments

Thank you for sharing this information. That's what I looking for.
- Log in to post comments