Copying bitlocker encrypted drive

[zx81]

When I cloned the Samsung 2TB ssd C: drive from my laptop (using Samsung migration software) to another exactly same Samsung ssd (which I keep temporarily in a usb caddy to be removed & replaced into laptop in case of emergency), it gave a message saying the C: drive was encrypted and would need to be decrypted before cloning which could take quite a while.

I decrypted it but never bothered re-encrypting because I didn’t want to keep doing it again for future clones and also someone told me this is a requirement of all such programs. But my data is vulnerable if the laptop is stolen.

So before I re-encrypt it, my question is: I know Hasleo Backup must be superior to Samsung Migration software, so can it clone an encrypted drive to another ssd in a usb caddy without the need to first decrypt it? Also can it image encrypted C drive.

I know Hasleo say it preserves BitLocker encryption after restore, but don’t know if this means encryption has to be disabled and then re-enabled with same key, or if it all just works. I don’t want to re-enable it, without asking first.

[admin]

Hasleo Backup Suite currently only supports backing up and restoring BitLocker encrypted drives while maintaining encryption; the cloning feature does not currently support maintaining encryption. However, you do not need to manually decrypt the drive before cloning, because Hasleo Backup Suite uses VSS for cloning, and the data it reads from BitLocker encrypted drives is already decrypted.

[zx81]

Hasleo Backup Suite currently only supports backing up and restoring BitLocker encrypted drives while maintaining encryption; the cloning feature does not currently support maintaining encryption. However, you do not need to manually decrypt the drive before cloning, because Hasleo Backup Suite uses VSS for cloning, and the data it reads from BitLocker encrypted drives is already decrypted.

Ok, just so I understand.

Unlocking bitlocker just refers to logging into my PC which decrypts everything automatically in the background. Whereas, manually decrypting a disk means disabling bitlocker on that disk, which removes its encryption completely.

So with Hasleo Backup Suite, system images and file/folder backups are backed-up with encryption intact and also restored with encryption intact.  No user intervention required.  Easy and simple. 

When cloning a bitlocker encrypted source disk, the encryption will remain intact on the source disk but will not be carried forward onto the target disk. Bitlocker encryption will need to be manually re-enabled on the new clone disk. 

Question: I assume the encrypted source drive which is being cloned doesn’t need to be installed inside the computer (eg. C: drive) and HSB can clone an encrypted external USB drive to another USB drive?

Question: Does all of this assume that when cloning an encrypted disk, HBS should be run from regular Windows system booted normally, so the disk will be unlocked and decrypted anyway. Rather than running it from WinRE/PE (whatever it’s called) rescue/boot media?

I ask this because a while back, someone on the Macrium reflect forum said the best way to create a system image or disk clone is to boot from the WinRE/PE rescue media and run the clone or image backup from there, so it will forensically duplicate every sector identically, whereas running it from regular Windows does not.  But does this mean the source system disk would still be encrypted because I wouldn’t be logged in to my user account?  So which is best method to run HBS?, from the actual installed program booting windows normally or boot from rescue media?

I want to get this all straight in my head. I have more cloning/imaging programs than I need and some are more limited than Hasleo. I have Hasleo Disk Clone pro, Hasleo Backup Suite home/family, Macrium Reflect 8, Samsung Migration tool, plus a few others.  But Hasleo software seems by far the most user friendly.

[al3x]

Hi,

ok, let me try to answer a few of your questions.
@admin: Feel free to join in and correct me if something in my reply should be wrong 

Here we go!

Unlocking bitlocker just refers to logging into my PC which decrypts everything automatically in the background. Whereas, manually decrypting a disk means disabling bitlocker on that disk, which removes its encryption completely.

Unlocking Bitlocker doesn't change any data on your drive, the encryption stays intact and data is decrypted in memory on the fly.
Decrypting unlocks the drive by rewriting all data on the disk unencrypted which removes BitLocker completely.

So with Hasleo Backup Suite, system images and file/folder backups are backed-up with encryption intact and also restored with encryption intact.  No user intervention required.  Easy and simple. 

In general that's right. But the details are important:
If you boot a WinPE image, VSS is not available. If you're currently within Windows, VSS is available.
Keep that in mind for the following:

Image backups:

If the source drive is BitLocker encrypted, currently unlocked and VSS is available (e.g. you booted a BitLocker encrypted OS), your data will be backed up BitLocker unencrypted. That means data is saved in the image file as if there was no BitLocker. That's why it's important to set a backup password to protect your image. If you restore (delta or normal) your data from that image, you'll have the option to retain BitLocker. So your data will be put back on the drive and BitLocker will be enabled like nothing ever happened.

If your source drive is BitLocker encrypted, but currently locked or VSS is not available (e.g. you booted from WinPE or try to back up a third partition that is still locked), your data can only be backed up sector-by-sector, which basically is a forensic copy of the BitLocker locked partition that can't be accessed or looked into directly. You can restore that as well, but only sector-by-sector as a large inaccessible binary block of data.

File/Folder backups:

Those will only work if your BitLocker partition is unlocked and files can be accessed. For restore, make sure your destination partition has BitLocker unlocked or doesn't use BitLocker at all. 
Data is restored by just copying the data back to the partition.

When cloning a bitlocker encrypted source disk, the encryption will remain intact on the source disk but will not be carried forward onto the target disk. Bitlocker encryption will need to be manually re-enabled on the new clone disk.

Just like with image backups, that is true if the source disk is currently unlocked and VSS is available, e.g. you booted into Windows and try to clone your system disk. Cloning will not keep BitLocker, your data will be unencrypted on your destination disk as if BitLocker was never enabled. You can then boot from your cloned disk and reenable BitLocker from scratch, which will take a bit because all data needs to be encrypted again.

Question: I assume the encrypted source drive which is being cloned doesn’t need to be installed inside the computer (eg. C: drive) and HSB can clone an encrypted external USB drive to another USB drive?

Yes, that can be done. Cloning a Windows partition to USB is only available in HBS Home or higher, not in the Free edition. See this comparison chart for details.

Remember: Destination disk will only be encrypted if you copied the locked source disk sector-by-sector.

Question: Does all of this assume that when cloning an encrypted disk, HBS should be run from regular Windows system booted normally, so the disk will be unlocked and decrypted anyway. Rather than running it from WinRE/PE (whatever it’s called) rescue/boot media?

In general I would always recommend to run HBS from within Windows so that you have VSS available. Only with VSS you get all the HBS features when it comes to BitLocker.

I ask this because a while back, someone on the Macrium reflect forum said the best way to create a system image or disk clone is to boot from the WinRE/PE rescue media and run the clone or image backup from there, so it will forensically duplicate every sector identically, whereas running it from regular Windows does not.  But does this mean the source system disk would still be encrypted because I wouldn’t be logged in to my user account?  So which is best method to run HBS?, from the actual installed program booting windows normally or boot from rescue media?

Your source disk will always stay encrypted and untouched, if that's what you ask. The method you choose only changes the outcome of the destination drive.

You can always clone your drives sector-by-sector while keeping your data BitLocker locked. But then you can't change the size of the destination partition because the data will be a huge (scrambled) binary block of data.

I personally would recommend unlocking (not decrypting!) your drives first. Then image/clone your data in that state.

HBS has you covered when it comes to images, you can always restore your data while retaining BitLocker. And for clones you can just reenable BitLocker. Yes, it will take some time but SSDs are still quite fast. Even if you only get around 500 MB/s and your whole 2 TB drive is full of data, your BitLocker encryption should be done in 1-2 hours.

I want to get this all straight in my head. I have more cloning/imaging programs than I need and some are more limited than Hasleo.  I have Hasleo Disk Clone pro, Hasleo Backup Suite home/family, Macrium Reflect 8, Samsung Migration tool, plus a few others.  But Hasleo software seems by far the most user friendly.

Totally get your point. It's sometimes confusing and BitLocker is quite complicated if you ask me .

I also tested a lot of tools and ended up sticking with HBS.
It just works

Hope my answers helped a bit!

Cheers,

[Bespoken]

You can always clone your drives sector-by-sector while keeping your data BitLocker locked. But then you can't change the size of the destination partition because the data will be a huge (scrambled) binary block of data.

I stay away from Bitlocker, but am always interested in the impact on backup/cloning/restore.

Please clarify the following situation:
- The PC has a 1TB Bitlocker encrypted source drive
- a second 1TB target drive is installed
- HBS clone from source to target using the ED (Bitlocker is not encrypted)
- the original drive is removed and the new drive is moved to that slot
Q1. Will the PC now boot normally from the target drive?
Q2. If that drive was moved to an identically configured PC, would it boot (it should not, which is the point of having Bitlocker)?

[admin]

Thank you, @al3x, for your excellent reply. I would like to add some supplementary points and a summary.

If the BitLocker partition to be backed up (cloned) is locked, then the backup (clone) will be of the encrypted data and can only be performed on a sector-by-sector basis, whether in Windows or in WinPE.

If the BitLocker partition to be backed up (cloned) is unlocked and VSS is available for that partition, then because the data read through VSS is decrypted data, the data stored in the backup image or cloned to the target drive is unencrypted. This is also why the program prompts about encrypting the image file during backup. As for why the encrypted state can be restored after restoring from the image, it is because the program re-encrypts the data during the restore process.

The above rules apply equally to both internal disks and external USB disks, so yes, HBS can clone an encrypted external USB disk to another USB disk.

Regarding whether the best way to create a system image or disk clone is to boot from WinPE recovery media, indeed in WinPE you can perform an exact sector-by-sector backup (clone) and completely rule out interference from third-party software, but its biggest drawback is that you must reboot into WinPE to complete the backup (clone). VSS cloning is indeed not a 100 percent exact backup (clone). First, creating a snapshot also takes a little time, and although the time is very short, some minor changes may still occur on the source disk. In addition, when a VSS snapshot is created, the system creates VSS snapshot files, and these snapshot files appear within the snapshot itself. However, VSS technology has been developed over many years, and we can fully trust that it ensures data consistency, where data consistency here refers to the consistency of all files except the VSS snapshot files themselves, and it has the huge advantage of allowing you to complete the backup (clone) operation without rebooting your computer.

Our recommendation is to perform the backup (clone) operation within Windows, and only perform the restore operation in WinPE, unless you truly need a 100 percent exact backup (clone) of the source disk.

Thank you all for your participation.

[admin]

You can always clone your drives sector-by-sector while keeping your data BitLocker locked. But then you can't change the size of the destination partition because the data will be a huge (scrambled) binary block of data.

I stay away from Bitlocker, but am always interested in the impact on backup/cloning/restore.

Please clarify the following situation:
- The PC has a 1TB Bitlocker encrypted source drive
- a second 1TB target drive is installed
- HBS clone from source to target using the ED (Bitlocker is not encrypted)
- the original drive is removed and the new drive is moved to that slot
Q1. Will the PC now boot normally from the target drive?
Q2. If that drive was moved to an identically configured PC, would it boot (it should not, which is the point of having Bitlocker)?

If this disk contains only data partitions, then cloning via ED is completely fine.

However, if this disk is a Windows system disk and you want the cloned Windows to be able to boot normally, then there is an issue. Since the BitLocker partition remains unlocked in WinPE, the program cannot properly identify the partitions related to the operating system. Moreover, the program can only clone the BitLocker partition in a sector‑by‑sector manner. The cloned partition will still be a BitLocker partition, and the program cannot modify the data within that partition (especially the registry files) to ensure that the system can boot normally. The end result is that you get a Windows clone that fails to boot properly.

Therefore, we recommend that you clone the disk within Windows itself to ensure that Windows can start up normally.

[al3x]

[...] The end result is that you get a Windows clone that fails to boot properly.

Therefore, we recommend that you clone the disk within Windows itself to ensure that Windows can start up normally.

Additionally to that: There are some ways to fix such a Windows that won't boot now. That includes running some commands like bcdboot from within WinPE. But it will be a hassle because you need to unlock BitLocker first etc. So the easiest method would still be to clone from within Windows.

Q2. If that drive was moved to an identically configured PC, would it boot (it should not, which is the point of having Bitlocker)?

Let's say those fixes with bcdboot etc. wouldn't be needed and the clone could boot from a technical standpoint. Then if you try to boot that clone in another PC, BitLocker would prevent the unlocking of the drive a 100% of the time.

That's because the hardware TPM wouldn't be available which holds the BitLocker key. And even if you cloned or moved the TPM somehow to the new PC, it would still refuse to boot because the hardware changed. That's a fundamental security feature of BitLocker and TPM chips. BitLocker would show a blue screen and request the input of the BitLocker recovery key first. Only after that it would unlock the partition.

[zx81]

Thank you for the detailed explanation. I like this forum. It’s a great source of information. The admin is present, responsive and helpful, and there’s many knowledgeable people who explain complicated technical things in clear simple terms and don’t ridicule anyone’s questions. This topic being a great example.

[Froggie]

"We" aim to please!