1

The general tenor around the internet seems to be that you can't create images of system partitions that have been encrypted (with truecrypt) other than with dd or similar sector-by-sector copy tools. These files however are very impractical given their size (and are obviously incompressible) which makes keeping multiple states/backups of your system partition rather expensive (..especially considering current hdd prices).

The problem is that backup tools (like Acronis True Image, Clonezilla, etc.) won't give you the option to create an image of (mounted/opened) Truecrypt partitions, or that there is no recovery environment for restoring the backup, that would allow to run truecrypt before doing any actual restoring.

After some trial and error however, I believe I have found a very simple way. Since Truecrypt (running in Linux) creates a virtual block device, that it uses for mounting the unencrypted partitions into the file system, partclone can be used for creating/restoring images.

What I did:

  1. boot up a linux live disk
  2. mount/open the drive/device/partition in truecrypt
  3. unmount the filesystem mount point again, like so:

    umount /media/truecryptX
    

    ("X" being the partition number assigend by truecrypt)

  4. use partclone (this is what clonezilla would do too, except that clonezilla only offers you to back up real drive partitions, not virtual block devices):

    partclone.ntfs -c -s /dev/mapper/truecryptX -o nameOfBackupFile
    
  5. for restoring steps 1-3 remain the same, and step 4 is

    partclone.ntfs -r -s nameOfBackupFile -o /dev/mapper/truecryptX
    

A backup and test-restore of the system (with this method) seems to have worked fine (and the changed settings were reverted to the backup-state). The backup file is ~40 GB (and compressible down to <8GB with 7zip/LZMA2 on the "fast" setting).

I can't quite believe that I'm the only one that wants to create images of encrypted drives, but doesn't want to waste >100GB on the backup of one single system state. So my question now is, given how simple this was, and that no one seems to mention anywhere that this is possible - did I miss something? or did I do something wrong? Is there any situation that I didn't think of where this method will fail?

Obviously, the backup file needs to be stored in some other encrypted place in order to still remain confidential, since it is unencrypted. Also, in order to do a full "bare metal" restore, one would have to actually first (re-)install Windows, encrypt it, and only then restore the backup file. The funny thing however is that you won't need to backup any partition tables, etc. since the reinstall will effectively take care of that. Is there anything else? This is imho still a lot better than having sector-by-sector images..

3
  • In terms of $/Byte current hard-disk prices must be millions of times cheaper than they were 10 or 20 years ago. Sep 5, 2012 at 10:03
  • @RedGrittyBrick: so, what's your point?
    – Dexter
    Sep 5, 2012 at 10:39
  • @Dexter - The point is. Its cheaper to duplicate the entire hdd sector for sector then try to come up with storage space workarounds such as this.
    – Ramhound
    Sep 5, 2012 at 12:22

2 Answers 2

1

I guess this could work.

However this guide is not detailed enough for a windows user...windows users are not familiar with Linux ;-) And especially not with Linux commands.

And as I am a windows user and not familiar with Linux I would not try this at home and would certainly fail at some point. I could not even get a list of directory contents, let alone find out which partition is which and so on.

Would this also work if the system drive has a (fully encrypted) C and D partition? If one would have to backup C and D individually, how should one restore C and D to the same drive afterwards?

Could you write a detailed guide how to do this for Windows users?

BTW you are right, the internet is full of sh*t regarding how to make a backup of a TrueCrypt encrypted system partition/drive. some zillion people probably already failed miserably by using TrueImage or DiskDirector to "backup" TrueCrypt system drives. TrueImage fails miserably (of course, for a lot of reasons) and DiskDirector fails to make a 1:1 clone of a hard disk. It is ridiculous. Still the internet is full of recommendations like this and people still use these programs (which do not work properly with TrueCrypt).

I, personally, therefore used CloneZilla to simply make a 1:1 clone (device to device copy) of the complete system drive (by start CD), end of story. However you have to make absolutely sure to get source and target drive right and disable grub and partition resizing in the expert options. This works perfectly, of course, but you need a 1:1 identical HDD to make a single backup. Still, better than nothing, and, as I said, this works.

Your method might work too, but as I am not a Linux guy I cannot fully understand or use it.

If you could make a step by step "windows guy" beginner guide how to make such a backup with PartClone I am sure that many "windows people" would appreciate that :-)

Thanks.

0

I use full disk encryption.

After fully encrypting the hard disk, I have successfully used Windows 7 Backup to create a system image, and then restored the resulting system image backup.

The restored system is unencrypted but still has the TrueCrypt boot loader. So, you must boot the TrueCrypt rescue disk and then restore the original Windows boot loader ("Restore original system loader" in the repair options) from the rescue disk.

You then end up with an unencrypted volume which you may re-encrypt if you choose.

I've read a similar approach can be used with Acronis True Image.

Mind you, the entire system image backup is also unencrypted and so there is no protection of the data it encompasses.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .