Veracrypt full disk encryption issues
I'm using Acronis True Image 2019 on a Windows 10 computer that has full disk encryption implemented using the program Veracrypt. I've found that the full disk encryption severely hampers my ability to create a full system drive backup that is restorable from an external non encrypted backup drive. I don't want to do a sector by sector backup because my system drive is large and it would be too time and space consuming. The problem is the system drive gets written unencrypted to my backup drive but it won't boot properly because the Veracrypt boot loader, which is also backup up, expects to see an encrypted drive now. Creating a WinPE or BartPE boot stick to try and get around this is just to frustrating and complicated a procedure for me. Does anyone who uses full disk encryption have a simple workable solution for handling this problem. It's funny Acronis doesn't have a work around for this issue in their software seeing that a lot of people must now be using full disk encryption. All they need to do is provide a simply way of restoring a normal boot record for their backups of encrypted systems? Hopefully someone out there has figured this out and has an easy workable solution? Not sure if I could boot from a non encrypted drive, run Acronis from it, and simply backup and restore the encrypted image of my system drive while it is not running. Probably Acronis wouldn't do the backup because it wouldn't see a normal windows drive just a bunch of encrypted garble, but I'm not sure! Might work with a sector to sector backup but again that involves to much time and drive space.
When using a system drive encrypted with Veracrypt, creating a backup of this drive using ATI will automatically create an UNENCRYPTED backup providing the backup drive is not itself encrypted with Veracrypt. The problem is the bootloader! Veracrypt uses it's own unique bootloader instead of the normal windows 10 bootloader and it expects to find an encrypted drive. This prevents the backup from booting properly on an unencrypted drive. What is needed is a utility that would restore the original Windows 10 bootloader and then the encryption would not be an issue. Why couldn't Acronis provide a simple utility for restoring a normal Windows 10 bootloader in their rescue media. Seems to me that this would be a simple thing to do and save a lot of problems with backing up a veracrypt encrypted drive. Perhaps restoring this windows 10 bootloader may already be doable using the bootable veracrypt rescue disk, I need to look into this further! If anyone has done this successfully let me know?
Sorry but as stated already, there is no support provided in the Acronis rescue media application for any encryption applications.
When any backup is created from within Windows using ATI, then it will always be of the unencrypted OS, including all other partitions that may hold bootloader code. The issue here looks to be that the Veracrypt bootloader is looking for an encrypted OS partition which Acronis cannot restore because the backup itself was of unencrypted data.
Thanks for the feedback Steve. Your assessment of the problem I'm having is bang on. I've often wondered why Acronis after all this time doesn't try and address this issue with backing up Veracrypt encrypted system drives. Perhaps it's because the solution isn't quite as simple as I think it is! Unless I underestimate the importance of disk encryption, I would think the majority of people would be using this technique by now to protect their sensitive computer data in the event that their computers got stolen. Maybe that's not the case however because year after year Acronis seems to do nothing to address this issue? Restoring the Windows 7 master boot record always worked well for me when restoring a backup from a Veracrypt encrypted system disk. That however was with Windows 7 and I've never bothered to try a similar procedure on Windows 10 with a UEFI bios. I use to use a WinPE boot stick that had a master boot record restore and save program on it. Unfortunately, I don't have the WinPE stick anymore and it's way to much of a headache to try and recreate one again! Perhaps the Windows 10 boot record is restorable from the bootable rescue USB that can be created through the Veracrypt program. I'll have to look into that possibility. As for BitLocker, well that may be a totally different ball game as it's something I don't use.
Frazzle, found a good description here that describes how this scenario is handled by Macrium which looks to be identical to how ATI handles it too. The article is talking about Truecrypt but this can be taken as Veracrypt for all intents and purposes.
I have struggled to understand whole-disk encryption options when using ATI, and it seems the simplest is in this final para in the Macrium link:
"If you wish to image an encrypted partition that will be bootable on restore, you must take the image using the rescue CD. This can only be do in 'exact copy' mode, so will be slower than a normal image and will result in a larger file."
If I understand correctly, in terms of Acronis this means that to protect from a fatal disk error once encrypted by VC one needs to use a rescue disk both to back-up the encrypted disk (in sector-by-sector mode) and then to recover on a failure. In the past I had always done my backups using a rescue disk, but in recent years ATI has worked so well that I've "set it and forgotten it" or at least it makes my daily and weekly backups automagically. Versus of course making reminders to myself to reboot my PC using a rescue disk and making the backup "by hand" and all that implies. Ugh.
From the same MR KB page:
TrueCrypt:
If you restore a system partition using the rescue CD, it will be restored un-encrypted, TrueCrypt data volumes will be restored encrypted.TrueCrypt volumes will boot, you can bypass the TrueCrypt bootloader authentication by pressing Esc and then select the boot partition by number.
The key for full disk encryption (substituting Veracrypt for TrueCrypt) is that you can restore the unencrypted volume then bypass the Veracrypt bootloader by using the Esc key, then boot directly from the OS volume, followed later by re-encrypting that volume in Veracrypt.