A few queries about windows home drive encryption and imaging with Macrium

01. Can I successfully image my encrypted system drive with a Macrium boot disk?
02. Will the image created be encrypted or not?
03. If i unlock the system drive and image it will the image be encrypted or not?
04. if i restore an encrypted image onto a encrypted partition will i require the unlock key
05. If i restore an unencrypted image onto a encrypted partition will the result be an encrypted or unencrypted partition and will i require the unlock key to do this restore?
06. what exactly does BitLocker support do, if added to my Macrium bootable image?

Thanks - i have a new laptop and do not want to mess anything up at the onset

I cannot answer ALL of your questions. Others here might if they are currently active in this forum. I would suggest researching the Macrium forums until someone else is available.
Holiday and weekend you know.

The content on disk is always encrypted, bitlcocker decrypts on read in memory so the image will be encrypted

How Macrium Deals with BitLocker

1. Imaging Encrypted Drives (Without Unlocking):
   • Macrium can create an image of a BitLocker drive without unlocking it first.
   • It captures the drive's encrypted sectors, resulting in an encrypted image.
   • This works for backup, but restoring to a new drive requires manual decryption or re-encryption in the new OS.
2. Rescue Media with BitLocker Support:
   • During rescue media creation, you can add optional components, including BitLocker support, and choose to "Automatically unlock BitLocker encrypted drives".
   • When you boot from this media, any BitLocker drives attached during creation are unlocked automatically.
3. Benefits of Unlocking in Rescue Media:
   • Faster Operations: Enables intelligent sector copy for quicker imaging/cloning and Rapid Delta Restores.
   • Access to Contents: Allows viewing files within the encrypted volume in the PE environment.
   • Retains Encryption: Restoring to an unlocked volume maintains its encryption status after reboot.

@perfection

Perhaps you missed my post here can i suspend (not disable) my encrpyted drive on windows home
That thread was initiated by you and everything about Device Encryption on your new Lenova laptop, how to suspend/unsuspend ( disable/enable) has been explained in my post

Whether it is Bitlocker Device encryption in Windows 11 Home or Bitlocker Drive encryption in Windows 11 Pro while creating Macrium Rescue media, click on the Advanced button at the bottom, put a check mark in the Add BitLocker squre and click on "OK" as shown in the screenshot below. When imaging with Macrium Rescue media, Macrium Reflect will automatically unllock the disks/drives.



Now on the topic of BitLocker Restore outcomes

BitLocker Restore Outcomes​

When restoring a BitLocker-encrypted volume, there are three possible outcomes: Read here Restoring BitLocker Encrypted Partitions. An extract below

what if my Macrium rescue cd with Gitlocker support is created on my PC but used to image and restore my system encrypted partition of my LAPTOP?

Life is much easier without BitLocker, but you guys seem to like it.
I don't use it.

Stigg said:

Life is much easier without BitLocker, but you guys seem to like it.
I don't use it.

Click to expand...

I'm mobile most of the time and security is important to me. My System One and System Two are always in my backpack. I've used BitLocker for years and never had any problems.

While convenient, it seems to me that Macrium's rescue media "Automatically unlock BitLocker encrypted drives" option is like storing your Bitlocker keys on a post-it note wherever you keep your rescue media. If that's correct, I would not use it. I use Image For Windows (IFW), and it does not have such a feature. Instead, I suspend protection on the Windows 11 Pro system I want to restore before booting into the IFW rescue media, and then I can restore my system volume, which was imaged with the volume unlocked so in the plaintext state, such that it will be encrypted by Bitlocker on the fly, as it's being restored. This avoids needing to re-encrypt after rebooting and trashing the auto-unlock keys for my internal data and external backup drives, which are a hassle to get working again. I use a 1 TB internal drive as the primary storage for my images, so I normally suspend protection on both drives before booting the rescue media; there's a tutorial here that explains how to do that using manage-bde and PowerShell.

Note that I Bitlocker all my drives: system, internal data, and external data and backup drives. In the worst case, I boot into the rescue environment with all drives locked. Then I have to open a command shell and use manage-bde to unlock the drives I need to work with. It can be a challenge to match drive letters to locked volumes, because they're not the same as in normal Windows. That's why I set things up in Windows as previously described before booting the rescue media, which I'm normally able to do.

Like @Stigg, I bitlock nothing. Nor will I ever.