Restore and BitLocker


Author
Message
dyhs
dyhs
Proficient Member
Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)
Group: Forum Members
Posts: 188, Visits: 741
OS partition ( C: ) is BitLocker encrypted. I made an image backup of OS + 3 other partitions necessary to Windows (EFI System, MSR, and WinRE Recovery). 
During the backup task, OS was in unlocked state.

Afterwards, BitLocker encryption was removed. Later on, BL encryption was applied again, new keys were generated.

Let's say I need to restore the original image to same disk. 
My understanding is that, if Rescue Media has BL support and OS is in unlocked state during restore, then the image will be restored and encrypted on the fly (with current key, not the old one). 

On the other hand, if the target partition is not unlocked during restore, or there is no BL support in Rescue Media, then OS is going to be restored but not encrypted at all.

In any case, I will never need again the old password and keys that were in use when the OS was backed up originally. 

Have I understood it correctly?

I've read this old thread on the topic
https://forum.macrium.com/Topic14293.aspx


Edited 23 July 2017 11:43 PM by dyhs
jphughan
jphughan
Macrium Evangelist
Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)
Group: Forum Members
Posts: 14K, Visits: 82K
You've understood it correctly.  In your circumstance, there is absolutely no reason you would need to retain the original Recovery Key because you're not using the old key on the disk itself anymore, nor is the image captured from that time encrypted with it. Smile

Edited 24 July 2017 12:38 AM by jphughan
dyhs
dyhs
Proficient Member
Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)
Group: Forum Members
Posts: 188, Visits: 741
Thanks.

So, I only need to keep the old keys if I image-backup a partition in a BL locked state, because it's going to be restored with original encryption anyway.
I guess the same applies to any clone, regardless of locked or unlocked state. Is that right? [Edit: nope, my last sentence was not right. See jphughan's response].
Edited 24 July 2017 9:06 PM by dyhs
jphughan
jphughan
Macrium Evangelist
Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)Macrium Evangelist (21K reputation)
Group: Forum Members
Posts: 14K, Visits: 82K
dyhs - 24 July 2017 8:23 AM
Thanks.

So, I only need to keep the old keys if I image-backup a partition in a BL locked state, because it's going to be restored with original encryption anyway.
I guess the same applies to any clone, regardless of locked or unlocked state. Is that right?

If you capture an image in locked state, then you'd absolutely need to keep the Recovery Key(s) for any encrypted partitions included in the image. But your images will also be a lot larger because a) Reflect will have to capture every sector of the partition since it won't be able to tell which ones are actually storing meaningful data, and b) compression will be basically non-existent because encrypted data doesn't compress.

For a clone, I've never tried it, but I believe that if the source is unlocked at the time, the destination will be unencrypted, in which case no worries about keys.  If you clone a locked partition, then yes you should keep the keys, but cloning a locked BitLocker system partition (as opposed to a BitLocker To Go partition) may be a hassle. If you were ever to use that clone, the TPM wouldn't release the key anyway because it would detect that the hardware environment had changed, which would cause its platform integrity check to fail.  The same thing can happen even with a BIOS update, fyi.  I think at that point if you just enter the Recovery Key, the TPM should "re-seal" the new platform and trust it going forward, or worst case you might have to do some manual work with the manage-bde command line tool.  But again, I'm not sure because I haven't tried this scenario.  With BitLocker To Go there's no issue at all because those partitions don't use the TPM as a protector, and I remember somebody here saying a clone of a locked BitLocker To Go partition worked exactly as you'd expect.

Edited 24 July 2017 11:38 PM by jphughan
dyhs
dyhs
Proficient Member
Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)Proficient Member (327 reputation)
Group: Forum Members
Posts: 188, Visits: 741
Makes sense. Smile
GO

Merge Selected

Merge into selected topic...



Merge into merge target...



Merge into a specific topic ID...




Reading This Topic

Login

Explore
Messages
Mentions
Search