EFS encrypted files are restored empty
I had some backups made by Acronis True Image 2018. I restored different EFS encrypted files. They all were restored empty. Zero bytes length. Nonencrypted files were restored well.
I uninstalled ATI 2018, installed ATI 2017, remade backups. EFS encrypted files are restored well. Unfortunately I did not try to restore old backups using ATI 2017.
ErmineMD...I have conducted a test using ATI 2018 with a File/Folder backup that contained encrypted and un-encrypted files. The un-encrypted files restored correctly. The encrypted files restored at 0 bytes, just like yours.
Please report this directly to Acronis. I will also report this directly to Acronis.
I will also run a test using ATI 2017 and report the results later today.
FtrPilot
ErmineMD...I have conducted a test using ATI 2017 to restore the backup created by ATI 2018. ATI 2017 restored the encrypted file correctly. My conclusion is that ATI 2018 creates the backup correctly. The "bug" is in the recovery of the encrypted file.
I will report my findings to Acronis with a reference to this thread.
Thanks for reporting this.
FtrPilot
I have conducted an additional test using ATI 2018 to see if I could "mount" the .tib file using Windows Explorer, navigate to the EFS encrypted file, check the file size, then try to copy & paste to a different location.
The file size listed is the correct file size. However, I was able to "copy" the file to the clipboard, but when trying to "paste" the file to another location, Windows generated an error message.
I also tried to "open" the file directly, but nothing happened...there was no error message.
Note: I was able to copy and open unencrypted files in the .tib file.
FtrPilot
FtrPilot,
Sounds like the Active Protection is at play in your test. You could have a look at the processes in the app, it might show that it blocked your copy attempt or you might see it in the AP log.
Enchantech,
I have reviewed the Active Protecting "Activity" page and the log files. There is no indication that AP is causing the problem. I have run some additional tests with some interesting results:
ATI 2018 is unable to restore the EFS encrypted file. When trying to mount the .tib and copy the file, I get the error message listed above with AP turned on or off. When trying to restore the file, the restored file is 0 bytes, whether AP is turned on or off.
ATI 2017...when trying to mount the .tib and copy the file, I get the same error message that I get with ATI 2018. However, when I restore the file using ATI 2017, the file restores correctly regardless of AP being on or off.
Regards,
FtrPilot
Interesting, I recommend passing all that along to the developers if you have not already.
HI folks, are the EFS files/folders "unlocked / unencrypted" at the time of backup? If not, I suspect the true content is not accessible to Acronis - much to the same limitation as not being able to backup a bitlockered encrypted drive offline unless it is unlocked first.
The one thing that is puzzling/bothersome, to me, is that it would prevent the .tib from being mountable at all. If 2017 can restore the file, but not 2018, does sound like a bug though - did a support case ever get opened for this?
Bobbo...I believe that ATI 2018 has a problem, given that ATI 2017 will restore the EFS file correctly. I have provided the information to Acronis using feedback, and I have opened a support case.
Regards,
FtrPilot
I just had the same problem when trying to restore EFS-encrypted files from an origin (old) PC to a destination (new) PC. This is what happened:
- When I created the backup of 320GB of source files, the log showed no errors. I used the security setting that would unencrypt all the encrypted files. However, the entire backup file was only 4GB in size.
- When I tried to restore that backup to the new machine, every allegedly-formerly-encrypted file was 0KB in size. Although its name showed in Windows Explorer, the file was inaccessible. The 4GB consisted of files within the backup that weren't encrypted to begin with, all of which restored properly.
- After that failure, I imported the origin PC's EFS certificate for my account to the new machine.
- I created a new backup, leaving the encryption flag on.
- I tried to restore that backup to the new machine, and eventually it told me it would take several days to complete.
- I aborted that process and restored a single unencrypted file from the backup, which worked.
- I then tried to restore a single encrypted file from the backup, and the process would not complete.
- Next I just used Explorer to create straight copies of single encrypted and unencrypted files, avoiding Acronis entirely. Copying those to the new machine worked perfectly with the EFS certificate in place, so I am now doing it for all files.
- When I try to restore three encrypted files from a backup to the old (original source) machine, the three files took 10 minutes to recover, and none of them were readable after recovery.
- None of this happened with ATI 2017; maybe I should revert back.
This renders all of my Acronis backups of encrypted files useless with ATI 2018. It will not unencrypt files into a backup properly, and it will not restore encrypted files properly. Please let me know if I'm missing something. This is kind of a big deal. I did submit a support ticket with the same information.
Thanks!
quantumgr...My experience is that ATI 2018 definitely has an issue with restoring EFS encrypted files. My recommendation is to revert back to ATI 2017 when dealing with EFS encrypted files.
Thanks, FtrPilot. I guess that's what I'll do.
The support ticket response I received today was generic and no help at all. You'd think a problem like this wouldn't be allowed to survive for the six-plus months this thread has been alive, wouldn't you? It's huge, and a lot of users may not realize it until it's too late. I was "lucky" this was in an environment where a bad backup wasn't a death sentence.
Important note: one use case in my tests is definitely a death sentence. It may be true that ATI 2018 creates the "straight" backup correctly and that recovery is the problem. That would be solvable, apparently, with reversion to ATI 2017 for recovery. But at least in my case, ATI 2018 definitely doesn't create a proper backup if you ask it to unencrypt the files in the backup's security settings in the Advanced tab. In that case, encrypted source files are backed up at 0KB. I never tested that with ATI 2017, but it probably works properly there.
A new version of ATI 2018 was released today, but this issue wasn't in the release notes and the new version has the same problem.
FtrPilot, thanks for the response and for all your research on this thread. It's a huge help!
Since this issue has been dragging on for seven months, I thought I should post that Acronis did respond to my support ticket in a second reply and admitted the issue was known. Specifically, they said:
"...this a known issue of an EFS encrypted files are incorrectly recovered as 0 KB files in ATI 2018 and the issue will be fixed in the next version for Acronis True Image. Once the new update is installed, you will be able to access the options for the backup. Unfortunately, we do not have any tentative date for the release of the fix, however, I suggest enabling automatic notification of new release in Acronis True Image application settings..."
In a third response, they addressed the backup problem as well:
"...this is also a known issue with Acronis True Image 2018 of "EFS encrypted files are not backed up if "store encrypted files in a decrypted state" is enabled". This issue will also be fixed in the next version for Acronis True Image. Unfortunately, we do not have any tentative date for the release of the fix..."
They also suggested that an ATI 2018 encrypted backup could be restored by ATI 2018 as unencrypted. I haven't tested that, however I'm suspicious of ATI 2018’s ability to recover EFS-encrypted files successfully from a backup without encryption, since it can’t back up EFS-encrypted files without encryption.
For what it's worth!
I just tried to restore my EFS encrypted files in Acronis 2017 - Everything is coming up 0bytes.
This is after testing EFS restores extensively in the beginning-
It appears that i will have to revert to a backup taken before i encrypted my files - I will be losing data.
Fortunately I started encrypting recently and did not encrypt everything.
This is a major failure even though i keep all kinds of back ups-
I had tried 2020 and had to go back to 2017 because it had a fatal error.
Acronis needs to stop making enhancements and focus on reliability - I won't be upgrading again unless they do.
Hello Michael,
sorry to know that you've faced this issue! It was fixed in Acronis True Image 2019 and shouldn't occur in Acronis True Image 2020. Have you tried restoring with a bootable media of Acronis True Image 2020?