Windows 10: Sector level backups on Surface Pro 4 - Bitlocker

I usually back up my standard PCs by booting from a USB drive and running a third party tool to create a sector-level backup to an image file that I store on an external drive. However, I have Bitlocker enabled on my Surface Pro 4 and wonder whether I will have issues either creating or restoring the backup of the physical drive. I suppose that I can disable Bitlocker before I create the backup, but will that create an issue if I attempt to restore the image file to the drive after I re-enabled Bitlocker? Thanks.

:)

 

Surface pro 4 needs Bitlocker recovery

Surface pro 4 needs Bitlocker recovery So what Should I do

 

BSOD on my surface pro 4

Hi,

You should contact Surface Support though they may not be able to help save data

that is encrypted. Depends on the actual cause of the BSOD which could be hardware

or other causes not directly related to BitLocker.

Surface Support

http://www.microsoft.com/surface/en-us/support/?lc=1033

Surface - Contact Us (AnswerDesk)

http://www.microsoft.com/surface/en-us/support/contact-us/

Surface - Online Service Center

https://myservice.surface.com/en-US/Pages/Welcome.aspx

Surface 4 Pro - Hardware and drivers

http://www.microsoft.com/surface/en-us/support/browse/surface-pro-4?category=hardware-and-drivers


=========

BitLocker is a professional level encryption program and should not be used unless one

really understands that it is secure and can not be broken by any usual or inexpensive

methods IF AT ALL. Only those with superior backup strategies should even consider

its use.

BitLocker is more frequently used and supported by those in the TechNet IT Pro Forums.

Windows BitLocker Drive Encryption Step-by-Step Guide for Windows 7 (and later)

BitLocker Drive Encryption Step-by-Step Guide for Windows 7

BitLocker recovery keys: Frequently asked questions

https://support.microsoft.com/en-us...cker-recovery-keys-frequently-asked-questions

TechNet - Bitlocker Overview

http://technet.microsoft.com/en-us/library/hh831713.aspx

TechNet - Windows 10 IT Pro

Technet forums - Windows 10 IT Pro

TechNet - Forums

Technet forums

TechNet - Where is the Forum For…?

Technet forums - Where is the Forum For…?

Hope this helps.

--------------------------------------------------------------------------------------------

Rob Brown -
Microsoft MVP <- profile - Windows and Devices for IT : Bicycle - Mark Twain said it right.

 

I believe Macrium Reflect Free can handle bitlocker installations.

 

Thanks, I'll study it further. I did see that the free edition requires a WinPE environment or the like to restore the image. Also, unless it allows a disk refresh to swap the USB boot thumb with the USB target drive, I'll have a problem unless I use a powered hub (only one port). I'd also like to be able to mount the image so I can copy files if necessary. As I recall, I can do the above with Partition Manager.

 

sector by sector copy does just that copies the sectors so it doesnt make any difference if its encrypted as long as you get all partitions its an exact copy

 

Thanks. Yes, this is correct. If I don't disable Bitlocker, I will acquire a sector level, encrypted copy of the disk. I can restore the encrypted sectors, which I hope will be decrypted when I log in to the restored image. They should be, but I was curious about whether there may be an issue.

 

Macrium is fine here if drive is unencrypted - you can create a boot entry for Other Tasks, so you can boot into winpe without using flash drive.

However, I do not know if that works if drive is encrypted - easy enough to test. Let us know what happens.

 

I use Macrium with Bitlocker.

If you make a backup from within Windows then that backup will NOT be encrypted as once a drive is unlocked it is transparent to other applications. You don't need to disable bitlocker. You can (if you want) backup to a external HDD that is encrypted with bitlocker (I do) but you need to unlock it from PE to restore. Or you can backup to a non encrypted volume.

If you boot into PE (either to restore or backup) then the bitlocker volumes are not accessible generally.

Assuming you don't unlock the volume you only option is a sector level backup and restore of the volume. This works fine but you will not be able to read the information on the backup - only restore the whole lot.

If you unlock the volume from the PE environment (using the powershell manage-bde command) you can use file level utilities as if the drive was not locked. Again you don't need to decrypt.

You have the option when making the Macrium PE drive to unlock the bitlocker volume automatically but this would be a terrible idea in my opinion unless you keep the recovery USB in a safe or something I suppose.

Sector level backups work fine with encryption - as mentioned above by @Samuria above the volume ends up the same so it doesn't matter if it is encrypted or not. Obviously sector level backups are MUCH slower.

 

Thanks. If you're talking logical sectors, yes, can image the logical sectors from the running system. However, the physical drive remains encrypted while the system is running, so you wouldn't use, for example, Windows System Image from within Windows. I do, however, think that I could image the physical disk with an imaging tool and then restore the image to the physical disk in the Surface. Physical imaging is substantially faster (the Surface drive is only about 512GB) and I always could boot the image in a different machine. Plus, the physical image remains encrypted, so I wouldn't be concerned about unauthorized access to the image file.

 

You could. If you make a Windows system image from a system running bitlocker then the image isn't encrypted unless you have previously encrypted the external drive.

Sure you could. I changed my HDD to SSD in my MacBook Pro (Windows encrypted with Bitlocker) using dd to copy from the HDD to SSD from Linux rescue USB. It worked fine.

I've not tried that but I imagine you'd have problems. The TPM would not automatically unlock the drive (so you'd need the 24 digit bitlocker key) and then Windows then wouldn't be authorized.