Skip to main content

Easy reilable imaging for Bitlockered disks (Sorry if this has been asked lots of times before)

Thread needs solution

Hi I have am looking at a y specific 'standalone' image backup and recovery solution

I have two Win10, Bitlockered workstations ( have the key info for recovery purposes).  The workstation have a lot of customised configuration on them and in the event of a disk failure etc., I want a quick simple recovery process.

I visualise the backup process being-  booting up from a DVD, backing up (imaging) the entire internal disk to an external USB drive as a file.

I visualise the restore process being-  booting up from a DVD, restoring the image file from the USB disk to the internal disk (or a new replacement internal disk) and then rebooting and entering the Bitlocker key when prompted to gain access to the entire system as before.

Does Acronis provide a solution that fits with this idea or similar. Open to different suggestions as long as it complies with the below:

-internal hard disk must be Bitlockered
-backup and recovery must be simple to use
-would prefer that no additional software is installed on internal drive OS, so the imaging process is purely while the OS on the internal drive is 'offline'

0 Users found this helpful

Welcome to these user forums.

The simple answer to your question is no.  Acronis True Image will not backup a BitLocker encrypted drive when using standalone boot media (CD/DVD or USB stick).

See KB 56619: Acronis True Image: compatibility with BitLocker which states the position on this officially from Acronis.

In essence, you would install Acronis True Image within the Windows OS and then run this as an OS application to perform the full disk backup of the OS drive while it is accessible due to BitLocker being unlocked at that point.

The backup image file produced by the above process would be unencrypted with regards to BitLocker protection but can be encrypted by Acronis True Image so that only the person who has the password encryption key can access the contents.

When restoring the backup image file, this would again be restored without BitLocker being active and you would then need to re-enable BitLocker protection.

Part of the reason why this is not possible offline from the OS is simply how the data is presented on the drive when it is encrypted, which due to the encryption process could show as bad sectors, corrupt data etc, making the backup process unreliable unless you use a hardware drive cloning solution that copies from source to target drive on a bit for bit operation.

Thanks so much for the advice Steve, that really helps.

So If I do use and installed Acronis TI with Bitlocker, I can expect a considerable amount of time added for True Image to:

- unencrypt the Bitlocked data while backing up

- encrypt (using TI option) the unencrypted data to the external drive while backing up

- unencrypt the TI encryption from external to internal drive while restoring

- encrypt (using Bitlocker) the unencrypted data on the internall drive after restoring

... this is a massive time overhead.

Steve I'm interested in the  hardware drive cloing solution - Doesn't Acronis provision for a  bit for bit/sector by sector imaging operation?  that wouldn't care what was on the disk?  I am not interested in partially restoring data or selectively looking at it from the images.

BangBangChicken wrote:

Thanks so much for the advice Steve, that really helps.

So If I do use and installed Acronis TI with Bitlocker, I can expect a considerable amount of time added for True Image to:

- unencrypt the Bitlocked data while backing up   No - the drive is already unlocked / unencrypted as Acronis sees it.

- encrypt (using TI option) the unencrypted data to the external drive while backing up  No - this is integral to the backup process

- unencrypt the TI encryption from external to internal drive while restoring  No - again integral to the application process

- encrypt (using Bitlocker) the unencrypted data on the internall drive after restoring Yes, as it would be for encrypting any new drive

... this is a massive time overhead.

Steve I'm interested in the  hardware drive cloing solution - Doesn't Acronis provision for a  bit for bit/sector by sector imaging operation?  that wouldn't care what was on the disk?  I am not interested in partially restoring data or selectively looking at it from the images.

Acronis does provide options for doing sector-by-sector backup imaging but as has been extensively discussed in another recent forum post on a related subject with regards to forensic recovery of data from a backup image made in this way, it was shown that this is still not a absolutely faithful bit for bit representation of the original hard drive even though it is 100% perfect to restore the backed up OS and all data.  The difference being in the data held in 'unused' sectors which when you introduce BitLocker encryption as well makes the process that much more complicated as to how to identify what is used or unused when the sectors contain unreadable encrypted information!

One hardware solution that I and others use is a Dual Bay Hard Drive Dock which can work completely independent of any computer.  I bought an Orico Dual Bay Hard Drive Dock from Amazon and have been very pleased with it, especially the solid build with an aluminium casing.  See the linked Amazon page for more details plus this will show other similar products.

Nice one Steve, Great to know that my precieved overheads are not even half as bad as I thought. 

However heavily tempted with the hardware solution as it will garuntee a like for like duplicate on another drive (bitlocked as a result of cloning ofcourse), which can then be used to replace a potentially duff hard disk in the same PC.

Thanks again.

We use clone bays at work for encrypted drives as well. For enterprise, we use the expensive Kangaru's which can also do FIPS wiping of multiple drives, but the $30-$50 dual clone bays on Amazon work just fine.  The main thing is that you have to clone from the same size disk to the same size disk.  Encryption "blows up" when you attempt to make any partition changes to currently encryptd (drive that has not been unlocked) prior to booting it.  So in that regard, I have not had good luck cloning an encrypted drive that is 250GB to a new drive that is 500GB.  And these docks won't let you clone from a larger to smaller drive either.

Thankyou for the additional advice Bobbo - the drive size being larger does add an extra layer of risk/complication and concern, so duly noted!

Steve:

I did exactly what you recommend and was able to restore an image that came from an encrypted laptop to another that was not.  The restored (unencrypted of course) laptop booted and works fine, kind of.  This is Win7 32bit and it seems to be working fine but so far I have found a few apps that don't work, they are IE 11, Wordpad, and Acrobat.  It is very strange, you can see the exe load in Taskman but no GUI is presented.  And they keep a steady 25% CPU utilization.  I have looked at this process with the SysInternals Procmon and Procexp and have not been able to find what could be causing the problem.

From what I have seen it could be related to a permissions issue to various folders, it does not matter if I use an Admin user or if I run the app as Admin.  I even created a new user in case the problem was related to a corrupted profile but that did not help either.

Do you have any idea of what may be going on?????

Thanks.

      Carlos

 

 

Carlos, welcome to these user forums.

If you have specific applications that are giving issues after the restore, but the OS itself is working OK, then I would recommend reinstalling those apps again - this is certainly possible with IE 11 and Acrobat, though I have never tried with Wordpad as have never used it - I use the freeware Notepad++ editor which does all I need it to.