How do I Back up an encrypted container?
Hi everyone, Leo Notenboom here for Askleo.Com.
Ask Leo is free partly because of my patrons.
Visit askleo.com/patron for more information about how you can support
Ask Leo and get access to Patron exclusive content.
Let's dive right into our question here.
"I'm very confused about Viracrypt
and how I should back it up. Do I back up the files? The container? What if I'm
using whole drive encryption? How do I back up the encrypted stuff?"
This is actually I'll call it
a conglomerate of several questions that I get.
It applies to encrypted containers like TrueCrypt, Veracrypt's predecessor,
and even BitLocker, and backing up encrypted drives in general.
Backing up is really, really important, don't get me wrong,
but it's interesting in that if you've got an encrypted drive or an encrypted
container, the answer isn't always obvious about exactly how you should back that up.
The answer can go either way.
What's important is that you understand
the ramifications of what it is you're doing.
In order to do that, we need to understand a little bit about how encrypted
containers work and how backup programs work.
So let's talk about first what it means to be an encrypted container.
Whole disk encryption isn't really impacted by this.
When you back up a whole disk encrypted drive using common backup tools,
you're backing up and in fact can pretty much only back up the unencrypted data.
Therefore, you have to basically secure your backups some other way.
But there's no question, there's no alternative.
Like I said, when you use a whole disk encrypted drive, it looks like a normal
drive, and it looks like a normal drive to your backup software as well.
So the encryption does not impact the backup software.
Now, when we talk about things like Veracrypt or TrueCrypt or even password
protected zip files, these are all containers, what I call containers.
They are standalone files that contain other files.
A zip file is a great example that I think most of us are familiar with.
You actually use it to create a single file out of a bunch of files.
When you throw a password on it, the contents of the.
Zip file are encrypted.
So what you have is an encrypted container.
If you want to access any of the contents
of that container, you need to provide the password.
The same is true for tools like Veracript,
where they have this opportunity to create what's called a vault.
A vault is a standalone file that is mounted and appears as if it were
an unencrypted drive, a separate unencrypted drive.
You access the encrypted data through this
unencrypted drive, and then when you unmount the drive,
the data is only available in its encrypted form.
Here's an example of what that looks like.
Conceptually, at least, what we have is our primary hard drive, C,
which contains all of our files, and on it I have this example file cdatamide.
Hc.
Hc happens to be the extension that Veracript uses for its container files.
What you see there is just encrypted data.
We haven't done anything with it,
we haven't mounted it, we haven't tried to access its contents,
and right now we can't because it's all encrypted.
Now, once you Mount the drive, what you're doing is you're telling
the viracrypt software, hey, this file over here, MyData HC Mount that.
And by the way, here's the password to unlock its contents.
What happens then is Veracript using the password and verifies that you have
access to the contents of the data, then makes that look like a mounted drive.
In our example here, you can see that it's mounted as drive v for Viracrit,
but you could choose other letters, whatever is available on your system.
The point is then that within V, all of a sudden you can see these files.
The files are all in the container, and they're all encrypted on disk.
But as you access them through viraccript through the v drive,
it handles transparently, encrypting anything you write to disk
and decrypting anything you read from that disk.
So it's a wonderful way to basically have a very large encrypted folder partition.
However you want to look at it that contains a lot of different files
without having to encrypt each file separately.
And it also allows you to not have
to extract a file, say from a zip file in order to access it and then put it back.
Everything is done transparently and in real time.
So what about backing it all up?
How do we do that?
There are two choices.
You can backup the encrypted file.
In other words, you can back up the HC file.
The HC file is an encrypted blob, but it contains everything in that blob.
So if you back that up, you've got everything backed up.
However, it does mean that in order
to access the contents of that backup, you'll need to presumably extract the HC
file from whatever technique you use to back it up, and then you'll need to use
a tool like viracrit to Mount it again and access its contents.
Now that may be enough.
That may be good enough for you.
That may be what you want to do.
The alternative is instead to while
the drive is mounted and drive v is visible, back up the contents of drive v.
That way you'll see the unencrypted data,
and it'll be the unencrypted data that you'll be backing up.
What that implies is that you really want
to secure your backups some other way or some way at all.
You've encrypted these files originally for a reason.
Presumably they are sensitive or something.
If you're going to back up the unencrypted files, then you probably want to make sure
that that backup is secured some other way.
The nice thing here is that once backed up, once they've been copied out of their
Vera crypt folder, or veracript vault, they're no longer dependent on viracrit.
If you copy them, say to a CD or a DVD or
some other backup media and then secure that, say in a safe physically secure it
somewhere safe, then you no longer need Veracrypt in order to read the files.
All you need is physical access.
Now, the combination here can get confusing.
Which one do you want?
And I honestly can't give you a real strong recommendation.
Either one is appropriate depending on your needs.
If your backups themselves are encrypted
or some other way secure, it kind of makes sense to back up the unencrypted files.
On the other hand, if your backups are not secure or you just want to keep things
simple and you're willing to rely on needing veracrit.
For example, if you ever do need those
backups in the future, then backing up the encrypted data may make the most sense.
But that's the important distinction.
You're backing up either the encrypted
vault, be it a veracript or TrueCrypt vault or a zip file with a password,
or you back up the unencrypted data making sure that the backups themselves are
appropriately secure for whatever scenario you're trying to protect yourself from.
I hope that's helpful.
I hope that clarifies a little bit.
Honestly, the big bottom line here,
of course, is regardless of which technique you used
for updates, for comments, for related links and more, visit askleo.com/5361.
I'm Leo Notenboom this is askleo.com. Thanks for watching.