Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm issued a SafeBoot encrypted computer at work, and I'd like to decrypt, clone, and then reinstall with something cross-platform like TrueCrypt. In order to have a clone that's useful at all, I need to backup while I'm logged in to Windows 7, otherwise I'll just be cloning encrypted data. My end goal is to have a dual boot system, but this is impossible with SafeBoot.

I do this regularly with Carbon Copy Cloner on my home Mac and it works fine. Surely there's something that makes a bootable backup for Windows 7?

Is what I'm trying to do feasible?

Spare any comments re. this not being a good idea. I'm aware of the risks, if any. I've conversed about my doings with a higher-up in IT who I know well, I've discussed my Linux use with the IT center, etc. They know, they don't care, but they're not going to help and I'm not going to ask my manager to sign stuff to authorize an actual decryption of my whole system (removal of SafeBoot) just for this.

I just want to see if it's feasible. If it's not, I'll just use VirtualBox or something.

Thanks for any suggestions.

share|improve this question
If this is a work computer, you really ought to talk to your IT staff about this. Chances are they won't want you changing the encryption scheme on your laptop. There are probably policies in place for liability which depend on you having their specific encryption software installed, and whether you like that or not, you should not go about trying to circumvent that yourself. – nhinkle Apr 15 '11 at 6:04
If you want to back up windows while booted into windows, see this question about cloning windows while it's in use. I don't know how you'll get the image back onto the newly re-encrypted disk though. – nhinkle Apr 15 '11 at 6:06
+1 for @nhinkle's comment. Companies have a specific data protection requirement (at least in US and UK) and if you breach it you could end up in a very bad legal/disciplinary position! Typically removing your safeboot protection is likely to breach their requirements. – Rory Alsop Apr 15 '11 at 9:08
@nhinkle/Rory Alsop: thanks for the suggestion. What surprises me is that I have, indeed, talked about this with my last laptop with my building IT guy. And not just anyone -- this guy is definitely higher up the ladder. At first I was running from a USB drive as to not change anything, but post-installing Linux over the whole thing, all he suggested to me was installing ClamAV for virus protection. I could go find some VP and get a blood-signed paper saying what I want to do is okay... but then again, there have been a reasonable amount of opportunities for stopping me; none have occurred. – Hendy Apr 15 '11 at 11:51
You might look at Storage Craft product, – Moab Apr 15 '11 at 16:11

Haven't used it myself but googling for Carbon Copy Cloner equivalent came up with a couple of options. Acronis TrueImage - I have used it but to be honest I had a few issues. I'm not sure if they're the program's fault, I tried to restore my backup to somewhat different hardware and ran into problems. I've also seen TotalRecovery (formerly DriveClone) recommended. Good luck.

share|improve this answer
up vote 1 down vote accepted

Thanks for all the questions. I stumbled on my own solution that I think is somewhat unique. It has the benefit of taking heed to the cautions above (not fiddling with company stuff -- at least not much), leaves everything encrypted, dual boots, and lets both OSs access shared data. In short, the solution was like so:

  • Defrag
  • Use Windows 7 partition table to shrink itself as small as possible (ended up being about 130G for me)
  • Create three more partitions form the resultant unallocated space:
    • 64M for Linux /boot
    • 30G for Linux
    • The rest for TrueCrypt
  • Use MiniTool Partition Wizard Home Edition to set the partition types that will be Linux based as having IDs of 0x83 (from their created ID of 0x7 for NTFS)
  • Use EasyBCD to create a Linux boot entry in the Windows boot options menu
  • Install Linux with LUKS/dm-crypt encryption
  • Install grub to the /boot partition, not the MBR
  • Create a TrueCrypt encrypted device from the last partition from either Win or Linux for shared storage

So... perhaps I've still "violated" the IT policy via the letter of the law -- I'm not positive, but don't really think this is the case based on talking about my plans with someone reasonably high in IT.

I've thought more about it, though, and called to mind that my company has no issues with people using their personal MacBooks at work, and I know on IT guy who uses one and uses TrueCrypt (or maybe it was FireVault) to encrypt his work files on it. Many probably don't encrypt at all, I would suspect.

So, if the issue is purely that this is "company property" vs. my personal computer, I may be an offender. If the issue is due diligence to protect everything, I've say I've covered the bases. Even more so, I've exceeded what I hoped for above -- the SafeBoot partition and default MBR are all still exactly as they were, safe being shrunk and a slightly modified partition table. I've verified that company patches still work, and thus I should be "on the grid" to the fullest with this setup.

I think all in all it was quite successful.

I wrote up the procedure HERE, as I hadn't seen anyone use this particular method in my searching. Thanks for all the comments.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .