Question I need help with Macrium Reflect backups with veracrypt encrypted hard drives. Is this method safe for back ups?

[Notmiserable]

I need help with Macrium Reflect backups with veracrypt encrypted hard drives. Is this method safe for back ups?


I want to encrypt a full OS hard drive with the main OS. I just have a few questions. I did some side research on this.

The original plan was I wanted to partition the hard drive to be about 500GB for main os. But for some reason, I think that is a useless method.

Because you can use a usb copy of reflect to go outside the hard drive (not using the main OS). So now you will get two encrypted partitions. One is the MBR partition (it's encrypted) and the full OS partition (it's encrypted). Now realizing that is indeed encrypted. You can still actually clone it to an image using Reflect. The downside of this is that, it must encrypt the whole 500GB partition. I have indeed discovered, with another computer, that I can take a hard drive out. I had an old hard drive lying around that was encrypted with a copy of Win7 OS. I hooked up it up as a secondary hard drive.

Now I can indeed use veracrypt and use Select Drive. I select the drive. And then I can go to mount without preboot authorization. And indeed, you can access to the data.

But this is where my research comes in. So, if I do backups that are 500GB of an encrypted main OS partition and the MBR partition. And then let's say I restore it this way. Some people say it can still work with this method, but there is another guy that says this:

"I booted into the clone HDD, or tried to, and realized that I could not decrypt it. Somehow, the disk encryption in VeraCrypt uses the disk info as part of its security. Maybe disk serial number or something unique to the disk. Meaning, a perfect clone will not decrypt. As the software realizes it has become a clone and refuses to boot."


So not only is this method risky, it eats up too much space. So if you clone a primary OS, it will only make that image the size of what you used on the hard drive. I don't necessarily want to use that method.


Here is what I want to do.

Each time I have to do a backup of my full primary OS partition and MBR partition. I want to decrypt it. And then run Reflect from a USB or another OS. I will calculate the space that they both use. I will make an encrypted container the same size on a USB external drive. Then I will have Reflect make a backup image in that encrypted space. Now, if I restore it, I decrypt that container that I stored the image on. Load it into Reflect and have it restore that image on the primary OS partitions.


The only thing I don't know is, how Reflect restores it. If it overwrites or deletes it to restore it. Does that mean it now deletes all the files on that unencrypted OS partition. And now the deleted files are set on the hard drive. Which means, if you delete a file in an unencrypted volume. Now I might be at risk with my personal files. So I don't know if this is a safe method? Am I still safe as long as I don't delete files on my OS before I reencrypt it again. Is this an okay and safe method?

 

[USAFRet]

I need help with Macrium Reflect backups with veracrypt encrypted hard drives. Is this method safe for back ups?

If it is Decrypted at time moment of the backup, the backup image will be unencrypted.

But I think you are overthinking this.

Are you doing full drive backup images?
Or something else?

 

[dwd999]

Perhaps it would be best to discuss this directly with the Veracrypt support people. Their instructions as to whether you can back up or clone a Veracrypt encrypted drive would be the proper guidance.

 

[Notmiserable]

If it is Decrypted at time moment of the backup, the backup image will be unencrypted.

But I think you are overthinking this.

Are you doing full drive backup images?
Or something else?

Full back image of main OS partition and MBR partition.

The transfer itself to a encrypted container (lets say I'm only using 25GB at the time on the main OS) I make the container 25GB. The main OS is unencrypted at the moment for the backup to the container. So the transfer of the full backup image that reflect makes to the encrypted container on USB. That is still encrypted.

But what I'm wondering about the restore process in case I need to. If I restore the image file that is now on the encrypted container (to the main OS hard drive) Does the restore process cause the main OS to delete these files now leaving me vulnerable to my personal data. It would be as if I was using my main OS hard drive and I have it unencrypted and I deleted file. Now that file is now vulnerable.

 

[USAFRet]

Full back image of main OS partition and MBR partition.

The transfer itself to a encrypted container (lets say I'm only using 25GB at the time on the main OS) I make the container 25GB. The main OS is unencrypted at the moment for the backup to the container. So the transfer of the full backup image that reflect makes to the encrypted container on USB. That is still encrypted.

But what I'm wondering about the restore process in case I need to. If I restore the image file that is now on the encrypted container (to the main OS hard drive) Does the restore process cause the main OS to delete these files now leaving me vulnerable to my personal data. It would be as if I was using my main OS hard drive and I have it unencrypted and I deleted file. Now that file is now vulnerable.

Encryption or no, restoring a Macrium Image to a drive wipes everything in the target drive (or partition).

 

[Notmiserable]

Encryption or no, restoring a Macrium Image to a drive wipes everything in the target drive (or partition).

And during that wipe it deletes now on an unencrypted drive. That's a huge problem right there. I perhaps maybe should go to the forums of veracrypt and ask or the macrium reflect forums.

Otherwise I would have to clone the full partitions as encrypted and restore as encrypted would be the only option. I'm kind of confused.

I will run a test now with method 1. Although it eats up way more space. It might be the safer of the two. Provided that what that other guy says is true that veracrypt security does not like anyone cloning an encrypted drive

""I booted into the clone HDD, or tried to, and realized that I could not decrypt it. Somehow, the disk encryption in VeraCrypt uses the disk info as part of its security. Maybe disk serial number or something unique to the disk. Meaning, a perfect clone will not decrypt. As the software realizes it has become a clone and refuses to boot.""

Maybe he is referring to a new drive. Oh wait, I think that method works as long as it's the same drive.

 

[USAFRet]

And during that wipe it deletes now on an unencrypted drive. That's a huge problem right there. I perhaps maybe should go to the forums of veracrypt and ask or the macrium reflect forums.

Otherwise I would have to clone the full partitions as encrypted and restore as encrypted would be the only option. I'm kind of confused.

I will run a test now with method 1. Although it eats up way more space. It might be the safer of the two. Provided that what that other guy says is true that veracrypt security does not like anyone cloning an encrypted drive

""I booted into the clone HDD, or tried to, and realized that I could not decrypt it. Somehow, the disk encryption in VeraCrypt uses the disk info as part of its security. Maybe disk serial number or something unique to the disk. Meaning, a perfect clone will not decrypt. As the software realizes it has become a clone and refuses to boot.""

My Surface laptop is BitLocker encrypted.
In actual use, it is unencrypted.
When I do a full drive Image in Macrium, it gives a warning that the Image is Unencrypted.

To Image a fully encrypted volume/partition/drive, you'd have to do it outside the native OS.

 

[Notmiserable]

Actually I think I did find a solution. Before I do a restore. I make sure that main OS drive is encrypted. So It wont delete any personal files in a wipe. Because the whole image is encrypted.

So before I restore. I re-encrypt the drive. Then do the restore. And then when I go back to the main OS. I then encrypt the drive again.

I may have answered my own question.

 

[USAFRet]

Actually I think I did find a solution. Before I do a restore. I make sure that main OS drive is encrypted. So It wont delete any personal files in a wipe. Because the whole image is encrypted.

So before I restore. I re-encrypt the drive. Then do the restore. And then when I go back to the main OS. I then encrypt the drive again.

I may have answered my own question.

If that works for you, great!

 

[Notmiserable]

If that works for you, great!

I'll see what other people say first on other forums. I know it sounds confusing but it's really not.

I just have to runs some tests and make sure it works. It's not often I will restore an image and make back ups. Provided the decryption and encryption process doesn't take a long time on a solid state. and the image file is not too huge. And runs off of USB 3.0.

I just want to see what people at the Veracrypt forums say about cloning a drive encrypted with their software and restoring as encrypted. I do think both methods work. It's just for the second method. When I restore it. I just need to leave Main OS drive as encrypted when I restore it. It will restore it with unencrypted files but wont delete any unencrypted files because they are replacing encrypted files when it wipes. I think I got this right LOL.