Aller au contenu principal

Success Adding BitLocker Support to the Acronis WinPE Bootable Media

Thread needs solution

I know one may directly encrypt ATI backups & store them on an unencrypted disc. Then they may be read by the Acronis Bootable Media. However, I would like to be able to store the ATI images on a bitlocker disc. Advantages of this are:

1 - don't have to have an unencrypted partition dedicated to only ATI images. May also store other data & keep it encrypted. (I feel it is not good security policy to keep any large unencrypted partition open. One may accidently place confidential information on it.)

2 - To fight programs such as CryptoLocker, keep the images "off-line" except when updating the images. This is accomplished by unlocking the image partition just before starting the backup & locking at the conclusion of the backup.

I have been able to add bitlocker support in the WinPE environment, make an ISO of that environment using Acronis WinPE ISO Builder. Then making a bootable USB key of the ISO file.

So far, my testing as not shown any problems. After booting from the USB key, I can use the MANAGE-BDE command to unlock the image partition, then recover files, etc.

I could not find instructions on how to accomplish this task. In fact, most of the information stated that it could not be done.

Are there existing instructions for this? If not, I can work on posting instructions for my process.

0 Users found this helpful

I would appreciate it if you could post what you added to the PE image.

I used the following commands to update the PE image. This is written for Windows 8.1 image.

rem should be run from the elect Windows Kits ® Windows ADK ® Deployment and Imaging Tools Environment
rem from the Start menu. **right-click & open with admin permission**
rd e:\winpe_x86 /s /q
call copype x86 e:\winpe_x86
Dism /Mount-Image /ImageFile:"E:\WinPE_x86\media\sources\boot.wim" /index:1 /MountDir:"E:\WinPE_x86\mount"
Dism /Add-Package /Image:"E:\WinPE_x86\mount" /PackagePath:"C:\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\WinPE_OCs\WinPE-WMI.cab"
Dism /Add-Package /Image:"E:\WinPE_x86\mount" /PackagePath:"C:\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\WinPE_OCs\en-us\WinPE-WMI_en-us.cab"
Dism /Add-Package /Image:"E:\WinPE_x86\mount" /PackagePath:"C:\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\WinPE_OCs\WinPE-SecureStartup.cab"
Dism /Add-Package /Image:"E:\WinPE_x86\mount" /PackagePath:"C:\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\WinPE_OCs\en-us\WinPE-SecureStartup_en-us.cab"
Dism /Unmount-Image /MountDir:"E:\WinPE_x86\mount" /commit

Thanks

When running manage-bde /Unlock H: -recoverypassword XXXXX-XXXXX-XXXXX from the Acronis WinPE Environment, I get the error code (0x80040154) "Class Not Defined".

I had to change the script commands i found (that add necessary modules for BitLocker) to drive letter to c: (was e: for some reason in the examples) to get the following commands to work:

rd c:\winpe_x86 /s

call copype x86 c:\winpe_x86 Dism /Mount-Image /ImageFile:"c:\WinPE_x86\media\sources\boot.wim" /index:1 /MountDir:"c:\WinPE_x86\mount"

Dism /Add-Package /Image:"c:\WinPE_x86\mount" /PackagePath:"C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\WinPE_OCs\WinPE-WMI.cab"

Dism /Add-Package /Image:"c:\WinPE_x86\mount" /PackagePath:"C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\WinPE_OCs\en-us\WinPE-WMI_en-us.cab"

Dism /Add-Package /Image:"c:\WinPE_x86\mount" /PackagePath:"C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\WinPE_OCs\WinPE-SecureStartup.cab"

Dism /Add-Package /Image:"c:\WinPE_x86\mount" /PackagePath:"C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\WinPE_OCs\en-us\WinPE-SecureStartup_en-us.cab"

Dism /Unmount-Image /MountDir:"c:\WinPE_x86\mount" /commit

It all appears to work, no errors.  I created a new WINPE boot disk thorugh Acronis (.iso) and booted from the disc but it didn't work.

I noticed that there are a bunch of directories in c:\winpe_x86\ that match the ones on my Original WinPE Acronis Boot Media, so I tried copying the files/directories onto/over the Acronis PE Media located on DVD-RW Drive D: and then selected 'Burn Image'. It said that matching files would be overwritten (its RW), I said OK and it finished OK. I booted from the revised disc but it didn't work. Got the error again.

So I then try rebuilding a new disc again in TrueImage -> Tools -> Create Bootable PE Media / Acronis Plugin.

The .iso file generated matched the old original one in size, so the procedure using C:\winpe_x86\ to add the modules didn't affect how Acronis builds the PE media.  Figured it wouldn't, but tried anyway just to see what would happen (my first quick attempt to fix the problem).  At this point, I am thinking it is most likely that the .iso must be manually generated, and to forget about using the Acronis PE Media Builder Tool altogether. 

So now what I did next was delete the contents of the c:\winpe_x86 directory and subdirectories (RD /s command) and replace them with the contents of the original Acronis WinPE Media Disc that I created through the TrueImage 2016 GUI.  I then ran the script commands again (except for the 'call' command), and to my surprise, they ran successfully on all commands.  I then dismounted the image, which saved it, and lastly ran the iso maker command:

oscdimg -n -bc:\winpe_x86\etfsboot.com c:\winpe_x86\Media c:\winpe_x86\winpe_x86.iso which generated an "updated?" .iso file.

At least I know these were definately the Acronis Files from the WinPE Boot DVD, and theoretically should have been updated using the script commands, right?

I then Burned the .iso file successfully, but unfortunately still got the error inside the WinPE Acronis environment...

What am I doing wrong?

8 |

If you are using TI 2016, you must make a 64 bit WinPE. You will need to change all x86 to amd64 in the above script.

1. Make the Acronis WinPE on a USB drive. (If you're dealing with a DVD, you need to use an ISO program to extract boot.wim from the souces folder in the iso file.)

2. Copy boot.wim from the sources folder of the USB drive to C:\Temp.

3. Go to C:\Program Files x86)\Windows Kits\8 or 8.1 or 10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\en-us and rename winpe.wim to winpe.orig.wim.

4. Copy boot.wim from C:\Temp to the folder in step 3. above and rename it to winpe.wim.

5. Now follow the script above using C: instead of E: and amd64 instead of x86.

6. Copy boot.wim from C:\winpe_amd64\media sources to the sources folder of the USB drive. Boot the USB drive and unlock your drive with manage-bde.exe. (If you're dealing with a DVD, use your oscdimg command to create a new iso.)

7. Go back to C:\Program Files x86)\Windows Kits\8 or 8.1 or 10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\en-us and rename winpe.wim to winpe.acronis.wim. Now rename winpe.orig.wim to winpe.wim.

 

 

OK great.  This worked!  I am exstatic!  Thank you Paul.  I know this well enough to teach someone else how to do it now. 

Thank you very, very, very... much!

-Eric

*SOLVED*

Eric,

You're welcome.

Works great, here was my script

rem should be run from the elect Windows Kits ® Windows ADK ® Deployment and Imaging Tools Environment
rem from the Start menu. **right-click & open with admin permission**
rd C:\winpe_amd64 /s /q
call copype amd64 C:\winpe_amd64
Dism /Mount-Image /ImageFile:"C:\WinPE_amd64\media\sources\boot.wim" /index:1 /MountDir:"C:\WinPE_amd64\mount"
Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-WMI.cab"
Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-WMI_en-us.cab"
Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-SecureStartup.cab"
Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-SecureStartup_en-us.cab"
Dism /Unmount-Image /MountDir:"C:\WinPE_amd64\mount" /commit

The package path is at Program Files (x86) not Program Files (amd64). 

I think I got it to work after rerunning the script. But first, had to dism

dism /cleanup-wim

 

I will try to do a manage-bde in WinPE now and post back with results!

Thanks to this thread, I'm finally able to deal with Bitlocker protected volumes from the bare-metal backup/restore.  Many thanks to the contributers here!

 

I noticed the image did not support some of the hardware on one of my systems.  A lot of hardware comes with drivers that can be extracted (rather than installed) and so used for installation and similar.  Turns out, those drivers also seem to work for the WinPE bootable media, and adding them while adding Bitlocker support is pretty easy.  First, extract the drivers (rather than installing them -- you probably already have them installed anyway).  Remember where you put the extracted files.  Also make note of the drive that contains the bootable medium you already created using the bootable media creation program Acronis provides.

While I was able to add support for soft-array hosts and network cards, trying to install drivers to support my video card (so I could run the backup/restore medium at native 2560x1600 resolution instead of the video card smearing it to that size) failed.  Maybe it is possible, but I did not try a lot of combinations since everything else I really needed was finally working.

 

For my examples below, I have the bootable medium as drive H:, and drivers supporting the onboard soft-array controllers and NIC on one of my systems extracted to subdirectories off E:\temp.  You will need to modify the respective paths appropriately for your system.

 

From the 'Windows Preinstallation Environment' I entered a number of commands:

rd c:\winpe_amd64 /s

call copype amd64 c:\winpe_amd64

rem Mount the image in the Acronis-created boot.wim so it can be manipulated

Dism /Mount-Image /ImageFile:"H:\sources\boot.wim" /index:1 /MountDir:"c:\WinPE_amd64\mount"

rem Following four commands add Bitlocker support as suggested here already.

Dism /Add-Package /Image:"c:\WinPE_amd64\mount" /PackagePath:"C:\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-WMI.cab"

Dism /Add-Package /Image:"c:\WinPE_amd64\mount" /PackagePath:"C:\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-WMI_en-us.cab"

Dism /Add-Package /Image:"c:\WinPE_amd64\mount" /PackagePath:"C:\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-SecureStartup.cab"

Dism /Add-Package /Image:"c:\WinPE_amd64\mount" /PackagePath:"C:\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-SecureStartup_en-us.cab"

rem Next line adds support for the JMicron SATA soft-array host on my board.

Dism /Add-Driver /driver:"E:\temp\gbsata\GSATA\Floppy64\xraid_f.inf" /image:"c:\WinPE_amd64\mount"

rem Next line adds support for the Intel soft-array capabilities on my board (actually, this was already seen by the default image).

Dism /Add-Driver /driver:"E:\temp\intelsata\64bit\IaStor.inf" /image:"c:\WinPE_amd64\mount"

rem Next line adds support for the Realtek NIC on my system board so I can use networked storage (my server, for example).

Dism /Add-Driver /driver:"E:\temp\rtnic\lan_win7\WIN7\64\rt64win7.inf" /image:"c:\WinPE_amd64\mount"

rem The next line finally dismounts the image

Dism /Unmount-Image /MountDir:"c:\WinPE_amd64\mount" /commit

 

Once it inidicated the image was dismounted, I told Windows to dismount the volume, then rebooted the system from the updated flash card, and was able to see my network card and volumes on arrays attached to my board's JMicron soft-array host (the Intel soft-array host was already supported but I decided to update the driver anyway), in addition to being able to manipulate Bitlocker protected volumes.

Sometimes I noticed that the Acronis backup/restore program did not notice when I unlocked a Bitlocker protected volume, but quitting the Acronis backup/restore program and restarting it allowed it to see the unlocked volumes, even on what were unseen drives before.

Unhappily, restoring (even after unlocking a volume) always seems to disable Bitlocker.  This means that Windows wants to encrypt the entire volume again to turn Bitlocker back on.

 

Since I run SSDs, I was hoping somebody had a way to let the Acronis program restore to a volume with Bitlocker enabled.  Not only would it be faster than re-encrypting the whole volume afterward, it would reduce the written sectors count (only writing the volume once to restore it rather than twice) and so reduce wear on the SSD.

I don't suppose anybody can help with this detail?

 

In case your are using a self encrypting drive (SED) you need "WinPE-EnhancedStorage" in addition.
Without this 'manage-bde -status' shows only Bitlocker software layer encrypted disks.

Dism /Add-Package ... \WinPE_OCs\WinPE-EnhancedStorage.cab"
Dism /Add-Package ... \WinPE_OCs\en-us\WinPE-EnhancedStorage_en-us.cab"

I have a self encryting drive Samsung 850 EVO 256 GB. Windows 10 pro installed, TPM, Secure boot and Bitlocker installed. Encrypting with Bitlocker took a few moments. I can make a backup with Acronis True Image 2016, but restoring does not work with SED (yet).

It would be great if someone posted a step by step manual to make a usb thumbdrive that can be used to restore a backup on a SED with hardware encryption and Bitlocker enabled. That also for a wishlist for Acronis. Thanks.

Hi guys,

Now that TrueImage 2017 is out, its time to upgrade, and rebuild our WinPE media.

So I went through the steps- I installed Windows ADK, I opened the ADK, I ran the script- this created a directory for me- c:\winpe_amd64. So I compared everything in this folder with the folder on the WinPE ISO provided by Acronis. The only different was the file \sources\boot.wim. So I deleted the file out of the WinPE original ISO, replaced it with the one I just compiled myself, burned and rebooted.

Now once I boot to the disk, manage-bde works great. HOWEVER, the command that actually launches the Acronis recovery, winpeinit (or something like that), isn't launching the window. So manage-bde works, but the recovery console won't actually open.

What did I do wrong? I can't remember how I made the recovery media for 2016

Thanks