Macrium Reflect - Issue Unlocking BitLockered Drive From Rescue Media

Got Macrium Refect Free 6.3.1835 running well on Windows 10. Except when booting from Macrium rescue media, I cannot unlock my C: drive.

My setup has a Bitlockered C: drive on a Samsung EVO 850 SSD, and my backup images are on E:, a portable BitLocker To Go USB3 HDD. My system is setup for UEFI/GPT boot.

The BitLocker encryption on C: has the Samsung self encrypting drive (hardware encryption) feature enabled. Test booting from a Windows Recovery Drive allows me to unlock BitLocker for both drives in the restore mode, by entering the keys.

In the Macrium Reflect Free rescue environment, I can open a command prompt and step through the manage-bde command lines to unlock E: (the external USB drive) just fine.

But when I attempt to do so for C:, I always get an error. It appears that the Samsung drive is available to be the restore target, but will be wiped during a restore. That would require re-enabling BitLocker afterwards and generating new keys.

The thing that puzzles me is that manage-bde is a Microsoft program, so I would expect it to work.

Any thoughts are welcome. Thanks!

telepro21 said:

Hello zzzoom,

I do not recall if the Macrium free version allows for the addition of the Windows Bitlocker environmentals to the Macrium Rescue Media. I am a paid-version Macrium user.

This knowledge-base article from Macrium may help--> Adding BitLocker support to Windows PE - KnowledgeBase v7 - Macrium Reflect Knowledgebase - KnowledgeBase v7 - Macrium Reflect Knowledgebase

Hey, thanks for the reply!

Yes it does. In fact you can create it two ways: 1) Include BitLocker support + automatically include keys; 2) Include BitLocker support without saving any keys.

I have tried both methods with Rescue Media. I can unlock E: just fine, but neither method allows me to unlock my C: drive.

I am posting here because you need a licensed product to join the Macrium forum. Hoping someone here can point out something I may be overlooking.

It´s not clear to me what do you mean by:

"The BitLocker encryption on C: has the Samsung self encrypting drive (hardware encryption) feature enabled."

Are you using BitLocker or a different Samsung encryption? Or both?

Anibor said:

It´s not clear to me what do you mean by:

"The BitLocker encryption on C: has the Samsung self encrypting drive (hardware encryption) feature enabled."

Are you using BitLocker or a different Samsung encryption? Or both?

Simple. Enable 'Encrypted Drive' in Samsung Magician. Reboot. Enable BitLocker in Windows 10. The entire drive is instantly BitLockered. No software encryption layer is necessary.

C:\WINDOWS\system32>manage-bde -status
BitLocker Drive Encryption: Configuration Tool version 10.0.14393
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Disk volumes that can be protected with
BitLocker Drive Encryption:
Volume C: []
[OS Volume]

Size: 232.33 GB
BitLocker Version: 2.0
Conversion Status: Fully Encrypted
Percentage Encrypted: 100.0%
Encryption Method: Hardware Encryption - 1.3.111.2.1619.0.1.2
Protection Status: Protection On
Lock Status: Unlocked
Identification Field: Unknown
Key Protectors:
Password
External Key
Numerical Password

I revisited this issue again yesterday. I am now running Macrium Reflect Free 7.1.2917, so with a fresh build of Win PE on my rescue media, I thought I would try again.

Still no luck with accessing or unlocking my encrypted Samsung SSD system drive. However unlocking my encrypted external USB drive, which is my image repository, works just fine. Can browse to the image to restore OK.

I realize that a workaround would be to just use 'Manage Bitlocker > Turn off BitLocker' from within Windows before attempting a restore. But I am assuming that in case I ever needed to restore, perhaps it's a good possibility that Windows would no longer boot. In that case I suppose I could also use the Samsung Magician boot utility 'Secure Erase' to reset my SSD to factory settings.

But I am really trying to understand why I cannot unlock my BitLockered C: drive. Whenever I attempt to use 'manage-bde –unlock C: -recoverypassword 111111-222222-333333-444444-555555-666666-777777-888888' from within the Macrium rescue environment, I get 'ERROR: an error occurred (code: 0x80070057)'.

If I boot from a Windows repair disk, I can enter the keys and unlock both drives.

Weird.

Here is a command window showing the 'manage-bde -status' for the two encrypted drives.

Just curious if you ever figured this out or maybe it fixed itself with the new version.

I am trying to decide whether to use Reflect Free or AOMEI for backing up bitlocker drives. I also wanted to post in the forum but discovered they dont let free users post. First product that doesnt even allow forum support for a free version.

Anyway, I use a pre-boot bitlocker pin on my system drive. I am wondering if that would complicate any bitlocker restores should a disaster happen.

cereberus said:

Macrium Reflect handles bitlocker fine.

Right.

Except for that little issue I described recently with a hardware encrypted drive. Macrium will not unlock it.

It is a Samsung SSD 850 EVO 250GB, with Encryped Drive 'Enabled' via Samsung Magician.

Not a showstopper, because if you restore to the BitLockered drive while it is still locked, you will be over-writing the drive with unencrypted data. You will just need to re-enable BitLocker on that drive after the restore, which will result in new keys being generated. So you will have to update all copies of the keys that you had stored for that drive.

It would be much easier if you could just unlock, restore to the unlocked drive, then re-lock using the existing keys.

And I suspect that this is not a Samsung issue, because I can unlock the drive just fine using a Windows recovery disk.