How should I back up an encrypted disk?
Hi, everyone. Leo Notenboom here for Askleo.com.
Let's get right to the question.
"I encrypt my hard disk with BitLocker, my backup program tells me it can only
perform a sector by sector backup, whatever that is.
So when I back up, is the backup encrypted or not?
If not, how should I backup securely?"
Unfortunately, I actually can't answer the specifics in this question because I
don't know what backup program you're using and why it's electing to default
to a sector by sector backup. That shouldn't be necessary.
And if you use the either of my recommended backup programs EaseUS Todo or Macrium Reflect, that won't be necessary.
It'll back up the contents of that disk just fine.
But it does really bring to light a very important question.
Your encrypted disks are encrypted for a reason.
Security.
On one hand, that could get in the way of backing up properly or it could make
those backups, well, significantly harder to access.
On the other hand,
it's possible to back up the data on those disks,
even accidentally in an unencrypted form without realizing it and as a result,
lose some of the very security you're attempting to get by having it encrypted.
Let's have a look at the various scenarios
that can happen when you're trying to back up an encrypted disk.
So there are two ways to what I'll call "See", an encrypted disk,
and that is when it's mounted or when it's not when it's not mounted.
In other words, it's not going to have
a drive letter associated with it, but it's still attached to your system.
The encryption is in place.
The only thing you can see is encrypted data.
If a backup program were instructed
to backup that disk, that unmounted partition or disk.
All it can do is, in fact, a sector by sector, a clone, if you will,
of that entire disk, because it doesn't know how to read the contents.
All it sees is encrypted data.
So all it can do is do a verbatim copy of that encrypted data.
On the other hand, if the disk is mounted as most BitLocker
drives are, when you're running, for example, your C drive,
if it's BitLocker is encrypted at the physical level,
but when you're using it, you're actually accessing it through
the decryption encryption process so that it all looks unencrypted to you.
When a backup program backs that up,
it has the option of actually backing up the unencrypted data.
Now, this, of course,
goes back to another choice of what the backup program wants to do,
because there are two ways of looking at that data.
If it's visible in its unencrypted form,
the backup program can be aware of the content.
This means that it understands the files
and folders and the data structures that are actually on the disk so that it
can retrieve the disk file by file, folder by folder and back it up that way.
Or it can be completely data agnostic
and once again fall back on backing up sector by sector doing a clone.
But in this case,
because the disk is mounted, if you're telling it to back up the C
drive, what it's going to see is unencrypted data.
That means that when you back up your bit
locker encrypted drive using tools like Macrium Reflect or EaseUS Todo to create
the kinds of backups that I so often recommend, an image backup, not a clone.
You're actually backing up unencrypted data as the backup program reads the disk.
The BitLocker software is decrypting the data and presenting it to the backup
program, just like it's decrypting the data.
When you open a file in, say, word or Internet Explorer or whatever
program you happen to be using to view the data on your disk bit longer makes
the encryption transparent while you're logged in.
And that's true for your backup program as well.
Now, if your system drive is backed up using something like BitLocker,
then you have two different approaches to go about backing it up.
The first and honestly, the one that I'll end up recommending
in a few minutes is to back it up within windows.
In other words, you boot into windows,
you run your backup program, and the backup program backs up the files
and folders on that disk in their unencrypted form.
The other approach, and especially for system disks,
this is often an approach that is the only approach for some backup programs,
and that is to boot into something other than windows.
You might boot into a recovery disk or
a utility disk provided by the backup program and then boot up the hard disk
in its encrypted form since you're not mounting it.
The only thing you have access to is
the encrypted data, and that's the only thing that could be backed up.
There are times when that's the right thing to do, but it's not what I suggest,
what you really want to understand is regardless of the technique you're using,
is the backup you've just created encrypted.
If it is, it's likely a sector by sector clone of the hard disk.
Then the only way to restore that backup, of course, is to restore the entire backup
to a hard disk and then mount it using whatever the encryption software was.
If it happens to be a BitLocker,
that should just be part of the normal boot process if it's not encrypted.
In other words, if it's a traditional image backup of the hard drive contents,
then you need to take additional steps to encrypt the result or store
that unencrypted backup in a more secure way, some other secure way.
So the question you need to understand the answer to is, is the backup encrypted?
If you did a sector by sector backup of the encrypted data by not mounting
the drive by, just backing up a partition that happened to be encrypted,
that was on the disk, but again, not visible, you didn't access it by C or
D or some other drive letter, then the only way to restore that is
to restore that data in its entirety to a disk and then use whatever encryption
software you had to remount the drive and access its contents.
It's actually not what I recommend.
The other approach is when you're backing up the data.
Normally when you do a normal image backup of a mounted drive.
So if you tell EaseUS Todo
or Macrium Reflect to back up the C drive,
it's going to back up the contents of that drive in their unencrypted form.
I prefer that because it's one less thing to go wrong.
Should you ever need to recover information from that backup
if you need that backup encrypted or secured some other way,
then encrypted it separately, encrypted using a different technology,
or maybe have the backup program, put a password on it so that the backup
program is natively encrypting the data as it writes out the image file.
That's ultimately my recommendation.
When you back up,
I recommend you use a tool like Macrium Reflect or EaseUS Todo to backup
the contents, not sector by sector, but the actual contents of your drives so
that they are not encrypted, so that they are actually stored
in the backup in their unencrypted form, and that you then separately
encrypt or otherwise secure the result of that backup using some other
technology, be it passwords in the backup program or zipping it with a password or
encrypting it with some other encryption technology or storing it in a safe place.
I hope that was helpful.
I hope that helps clarify a little bit
about how we want to go about backing up encrypted drives.
The bottom line is back up the encrypted data in its unencrypted form and then
secure it some other way. For links to related articles,
for updates, for comments and more, visit Askleo.com/25401.
I'm Leo Notenboom.
This is Askleo.com.Thanks for watching.