Sector level backups on Surface Pro 4 - Bitlocker

I usually back up my standard PCs by booting from a USB drive and running a third party tool to create a sector-level backup to an image file that I store on an external drive. However, I have Bitlocker enabled on my Surface Pro 4 and wonder whether I will have issues either creating or restoring the backup of the physical drive. I suppose that I can disable Bitlocker before I create the backup, but will that create an issue if I attempt to restore the image file to the drive after I re-enabled Bitlocker? Thanks.

Thanks, I'll study it further. I did see that the free edition requires a WinPE environment or the like to restore the image. Also, unless it allows a disk refresh to swap the USB boot thumb with the USB target drive, I'll have a problem unless I use a powered hub (only one port). I'd also like to be able to mount the image so I can copy files if necessary. As I recall, I can do the above with Partition Manager.

sector by sector copy does just that copies the sectors so it doesnt make any difference if its encrypted as long as you get all partitions its an exact copy

Samuria said:

sector by sector copy does just that copies the sectors so it doesnt make any difference if its encrypted as long as you get all partitions its an exact copy

Thanks. Yes, this is correct. If I don't disable Bitlocker, I will acquire a sector level, encrypted copy of the disk. I can restore the encrypted sectors, which I hope will be decrypted when I log in to the restored image. They should be, but I was curious about whether there may be an issue.

I use Macrium with Bitlocker.

If you make a backup from within Windows then that backup will NOT be encrypted as once a drive is unlocked it is transparent to other applications. You don't need to disable bitlocker. You can (if you want) backup to a external HDD that is encrypted with bitlocker (I do) but you need to unlock it from PE to restore. Or you can backup to a non encrypted volume.

If you boot into PE (either to restore or backup) then the bitlocker volumes are not accessible generally.

Assuming you don't unlock the volume you only option is a sector level backup and restore of the volume. This works fine but you will not be able to read the information on the backup - only restore the whole lot.

If you unlock the volume from the PE environment (using the powershell manage-bde command) you can use file level utilities as if the drive was not locked. Again you don't need to decrypt.

You have the option when making the Macrium PE drive to unlock the bitlocker volume automatically but this would be a terrible idea in my opinion unless you keep the recovery USB in a safe or something I suppose.

Sector level backups work fine with encryption - as mentioned above by @Samuria above the volume ends up the same so it doesn't matter if it is encrypted or not. Obviously sector level backups are MUCH slower.

Thanks. If you're talking logical sectors, yes, can image the logical sectors from the running system. However, the physical drive remains encrypted while the system is running, so you wouldn't use, for example, Windows System Image from within Windows. I do, however, think that I could image the physical disk with an imaging tool and then restore the image to the physical disk in the Surface. Physical imaging is substantially faster (the Surface drive is only about 512GB) and I always could boot the image in a different machine. Plus, the physical image remains encrypted, so I wouldn't be concerned about unauthorized access to the image file.

JimmyW said:

However, the physical drive remains encrypted while the system is running, so you wouldn't use, for example, Windows System Image from within Windows

You could. If you make a Windows system image from a system running bitlocker then the image isn't encrypted unless you have previously encrypted the external drive.

JimmyW said:

I do, however, think that I could image the physical disk with an imaging tool and then restore the image to the physical disk in the Surface.

Sure you could. I changed my HDD to SSD in my MacBook Pro (Windows encrypted with Bitlocker) using dd to copy from the HDD to SSD from Linux rescue USB. It worked fine.

JimmyW said:

I always could boot the image in a different machine.

I've not tried that but I imagine you'd have problems. The TPM would not automatically unlock the drive (so you'd need the 24 digit bitlocker key) and then Windows then wouldn't be authorized.

I restored a bitlocker Windows 10 system-fs (C:\) 10 minutes ago with dd. I always wondered if this was going to work but it is working flawlessly!