12-21-2025, 01:33 PM
(12-20-2025, 05:53 AM)CDC9762 Wrote: Perhaps I'm mixing imaging programs but isn't a possible cause for differences in live vs non-live image file size being live uses VSS to collect what will be saved in the image file and non-live doesn't need to use VSS since the source drive is static?
How is a Bit-locked drive imaged without unlocking - wouldn't the basic filesystem be unavailable for the imaging program to determine which blocks are in-use?
In Windows PE environments, VSS is not available. For BitLocker-encrypted drives that are not unlocked, backups must be performed using sector‑by‑sector mode, as the program cannot parse the file system under such conditions.