True Image in Elevated Mode cannot backup BitLocker To Go USB drives in partition mode

Update: The drive was created long long long time ago and it was on a FAT partition encrypted with BitLocker To Go.

Reformat the drive to NTFS and re-encrypt the drive to BitLocker To Go and restart, then I see the attached when trying to create a new backup task. I cannot proceed further. In an elevated command prompt, I can see all the files in the USB no problem.

I have to say though, I cannot backup in partition mode but when backing up in file mode, it goes okay. In either mode, the backup is AES encrypted with a password. Want to see the security implication between partition mode and file mode when I have to use BitLocker To Go in the first place.

Still, would like to see if anyone can offer a reasonable workaround re Elevated Mode?

Chris, welcome to these public User Forums.

You should be running ATI from an Administrator level account, and your BitLocker encrypted drive should be unlocked or set for auto-unlock in the BitLocker control panel.

Check the status of the encrypted drive from a command prompt by running the command:

manage-bde -status D:

C:\WINDOWS\system32>manage-bde -status L:
BitLocker Drive Encryption: Configuration Tool version 10.0.17763
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Volume L: [Toshiba]
[Data Volume]

    Size:                 184.17 GB
    BitLocker Version:    2.0
    Conversion Status:    Used Space Only Encrypted
    Percentage Encrypted: 100.0%
    Encryption Method:    AES 128
    Protection Status:    Protection On
    Lock Status:          Unlocked
    Identification Field: Unknown
    Automatic Unlock:     Enabled
    Key Protectors:
        Password
        Numerical Password
        External Key (Required for automatic unlock)

The backup task would need to be created when using an Administrator account after which you may be able to use a Pre Command batch file to unlock the drive when running the task.

rem Unlock BitLocker protected drive from WinPE
manage-bde -unlock L: -rp 62***-1****6-4****3-3****2-7****1-1****9-1****1-3****5
exit

I am able to create a backup task to backup my own external USB which is encrypted by BitLocker to Go and run this task without issue.

Hi Steve,

I use an account which is in the Administrators local group so this fulfils the first requirement.

Command Prompt no issues:

C:\Windows\system32>manage-bde -status D:
BitLocker Drive Encryption: Configuration Tool version 10.0.17134
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Volume D: [Kingston]
[Data Volume]

    Size:                 1.86 GB
    BitLocker Version:    2.0
    Conversion Status:    Used Space Only Encrypted
    Percentage Encrypted: 100.0%
    Encryption Method:    AES 128
    Protection Status:    Protection On
    Lock Status:          Unlocked
    Identification Field: Unknown
    Automatic Unlock:     Enabled
    Key Protectors:
        Password
        Numerical Password
        External Key (Required for automatic unlock)

The "Administrator" account is disabled by default in late Windows versions, so I will let this account disabled.

Again in my normal day-to-day account, I fire up ATI and click yes to the User Account Control to let ATI run in admin privileges. Still unable to create the backup task in partition mode due to the drive being locked in privileged mode (see 485065-162499.png per attached). Did you create the backup task in partition mode or in file level mode? Most importantly, what security implications do you think there are between these 2 backup modes, provided they are both AES encrypted with a password? Appreciate your insight on this sir.

This is a small but critical drive which I store in a safe and access very occasionally. Speed is no concern but security, is.

Regards,
Chris

Chris, right-click on the ATI program icon / launcher then open the Properties window, change to the Compatibility tab then change the settings for all users to use Run as Administrator.

My own backup was of Disk & Partitions for the whole encrypted USB drive.

Hi Steve,

Changed C:\Program Files (x86)\Acronis\TrueImageHome\TrueImage.exe to run as admin for all users [attached], still got the same User Account Control dialogue when firing ATI. Anyway, still got the same error "Unable to back up a locked volume encrypted with BitLocker. Unlock the volume or turn off BitLocker and then try again.".

Only differene is that I am using ATI 2018. The drive was set to auto unlocked.

I don't have much exposure about the security implication on running a backup in file level mode (AES encrypted), but I am more comfortable with this approach. This backup file will then be backed to Amazon Glacier as the final destination. At lease performance is not an issue.

Thanks very much for the input, Steve.

Regards,
Chris