Helping people with computers... one answer at a time.
BitLocker is Microsoft's encryption technology available in some versions of Windows. I'll explain why I don't use it and don't recommend it for backups.
I recently had the unfortunate situation where I needed to recover my system from a backup stored on a USB drive that was 'BitLocker Drive Encrypted'. When trying to restore from the boot sequence, both Acronis Backup and Windows Backup (yes, I had two versions of my backup) were unable to read the drive that my backup files were encrypted on. Fortunately, I was able to decrypt the USB drive that the backups were on, but this took nearly 20 hours to do before I could recover my system properly. Is there a way to access and unlock a BitLocker-encrypted drive from the boot-up sequence and then recover my system without having to go through this long, drawn-out process? With the Windows backup, I had to unlock my system hard drive before I could proceed to the backups, but it didn't allow access to the drive where the backup was stored. Surely, someone at Microsoft should have thought of this when they designed the OS? Or are they that dumb?
No, they're not that dumb.
They're just operating from a different set of assumptions.
You assumed that putting a backup on a BitLocker Encrypted Drive would work, and I'm guessing that Microsoft assumed that this would be outside of BitLocker's scope. With BitLocker, Windows needs to be running and you need to be logged into your account. So if you're restoring, it just doesn't make sense if Windows isn't completely running.
That's just one of the problems that I have with BitLocker, and one of the reasons why I avoid it completely.
The fundamental approach that you've taken with your backups is somewhat problematic, no matter what encryption technique you use. As we'll see, it can be particularly problematic with BitLocker.
The problem is this: you're assuming that the technology will be in place at recovery time so you'll be able to decrypt your encrypted backup.
Unfortunately, when performing a restore of a system image, the recovery software may be running on a very bare-bones copy of Windows - or it may not be running Windows at all. In either case, the decryption component that you need may not be in place.
There's also the possibility of a chicken-and-egg scenario. When you use BitLocker, it uses information from your logged-in account and a decryption key kept on the machine to decrypt the information. If that's in the image that you're trying to restore... well, you need the key to decrypt the data, but you need to decrypt the data to get the key. You're stuck.
The same may be true of other encryption technologies, such as my preferred alternative, TrueCrypt. I know that, when using my Acronis recovery disk, I'm not given a way to load TrueCrypt so I can't decrypt anything if I've stored my backup image in a TrueCrypt volume or drive.
Now, it may be that Microsoft does have some way to deal with the backup restore scenario that neither of us are aware of. But, that's not my only concern with BitLocker.
As I said, I avoid BitLocker like the plague. I'm sure that it's fantastic encryption technology and, when managed properly, it might well be appropriate for some: perhaps for well-managed corporate or institutional use. But I really don't like the assumptions that it makes. That's best summed up by this quote from a Microsoft write-up on BitLocker:
When a local administrator initializes BitLocker, the administrator should also create a recovery password or a recovery key. Without a recovery key or recovery password, all data on the encrypted drive may be inaccessible and unrecoverable if there is a problem with the BitLocker-protected drive.
Note the use of the word "should". It's simply too easy to enable BitLocker and not create a recovery password or key. It's also really easy to forget or misplace the recovery password or key because it's not required for day-to-day use.
The net result is that if you lose the login account that created it, or if you ever need to access that drive on another machine (say after a hardware failure) without the recovery information, the encrypted data is lost and gone forever.
It also concerns me that BitLocker is for Windows only and even then only specific editions of Windows. Even with the recovery information, you can still only retrieve the encrypted data on Windows machines that support BitLocker.
My recommended alternative is TrueCrypt, which is most commonly pass-phrase based for all access and is open-source and cross-platform.
Encrypting backups can be important, particularly because backups often contain sensitive information and are stored in less than completely secure locations.
There are two approaches that I recommend:
Use encryption offered by the backup tool. I know Acronis offers this as an option when configuring backups, and it's perhaps the easiest, most reliable way of securing the backup. Other tools may have similar capabilities. This way, you'll know that when you use that same tool to restore your backup, it'll be able to decrypt its own encryption.
Create the backup unencrypted, and then encrypt it separately. Naturally, I recommend TrueCrypt, but tools like 7-zip, AxCrypt and even PGP or GPG can be used. When the backup is needed, you can then decrypt it on another working machine and then restore from the decrypted backup.
As you may know, I believe backups are a critical component to using your computer wisely. I'm also a fan of encryption to keep your data safe from prying eyes. The two can and often should be combined, but make sure that they're combined in a way that both protects you and allows you the access that you need when you need it.
Comments on this entry are closed.
If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.
If you don't find your answer, head out to http://askleo.com/ask to ask your question.