A few queries about windows home drive encryption and imaging with Macrium

01. Can I successfully image my encrypted system drive with a Macrium boot disk?
02. Will the image created be encrypted or not?
03. If i unlock the system drive and image it will the image be encrypted or not?
04. if i restore an encrypted image onto a encrypted partition will i require the unlock key
05. If i restore an unencrypted image onto a encrypted partition will the result be an encrypted or unencrypted partition and will i require the unlock key to do this restore?
06. what exactly does BitLocker support do, if added to my Macrium bootable image?

Thanks - i have a new laptop and do not want to mess anything up at the onset

I cannot answer ALL of your questions. Others here might if they are currently active in this forum. I would suggest researching the Macrium forums until someone else is available.
Holiday and weekend you know.

The content on disk is always encrypted, bitlcocker decrypts on read in memory so the image will be encrypted

How Macrium Deals with BitLocker

1. Imaging Encrypted Drives (Without Unlocking):
   • Macrium can create an image of a BitLocker drive without unlocking it first.
   • It captures the drive's encrypted sectors, resulting in an encrypted image.
   • This works for backup, but restoring to a new drive requires manual decryption or re-encryption in the new OS.
2. Rescue Media with BitLocker Support:
   • During rescue media creation, you can add optional components, including BitLocker support, and choose to "Automatically unlock BitLocker encrypted drives".
   • When you boot from this media, any BitLocker drives attached during creation are unlocked automatically.
3. Benefits of Unlocking in Rescue Media:
   • Faster Operations: Enables intelligent sector copy for quicker imaging/cloning and Rapid Delta Restores.
   • Access to Contents: Allows viewing files within the encrypted volume in the PE environment.
   • Retains Encryption: Restoring to an unlocked volume maintains its encryption status after reboot.

@perfection

Perhaps you missed my post here can i suspend (not disable) my encrpyted drive on windows home
That thread was initiated by you and everything about Device Encryption on your new Lenova laptop, how to suspend/unsuspend ( disable/enable) has been explained in my post

Whether it is Bitlocker Device encryption in Windows 11 Home or Bitlocker Drive encryption in Windows 11 Pro while creating Macrium Rescue media, click on the Advanced button at the bottom, put a check mark in the Add BitLocker squre and click on "OK" as shown in the screenshot below. When imaging with Macrium Rescue media, Macrium Reflect will automatically unllock the disks/drives.



Now on the topic of BitLocker Restore outcomes

BitLocker Restore Outcomes​

When restoring a BitLocker-encrypted volume, there are three possible outcomes: Read here Restoring BitLocker Encrypted Partitions. An extract below

what if my Macrium rescue cd with Gitlocker support is created on my PC but used to image and restore my system encrypted partition of my LAPTOP?

Life is much easier without BitLocker, but you guys seem to like it.
I don't use it.

Stigg said:

Life is much easier without BitLocker, but you guys seem to like it.
I don't use it.

Click to expand...

I'm mobile most of the time and security is important to me. My System One and System Two are always in my backpack. I've used BitLocker for years and never had any problems.

While convenient, it seems to me that Macrium's rescue media "Automatically unlock BitLocker encrypted drives" option is like storing your Bitlocker keys on a post-it note wherever you keep your rescue media. If that's correct, I would not use it. I use Image For Windows (IFW), and it does not have such a feature. Instead, I suspend protection on the Windows 11 Pro system I want to restore before booting into the IFW rescue media, and then I can restore my system volume, which was imaged with the volume unlocked so in the plaintext state, such that it will be encrypted by Bitlocker on the fly, as it's being restored. This avoids needing to re-encrypt after rebooting and trashing the auto-unlock keys for my internal data and external backup drives, which are a hassle to get working again. I use a 1 TB internal drive as the primary storage for my images, so I normally suspend protection on both drives before booting the rescue media; there's a tutorial here that explains how to do that using manage-bde and PowerShell.

Note that I Bitlocker all my drives: system, internal data, and external data and backup drives. In the worst case, I boot into the rescue environment with all drives locked. Then I have to open a command shell and use manage-bde to unlock the drives I need to work with. It can be a challenge to match drive letters to locked volumes, because they're not the same as in normal Windows. That's why I set things up in Windows as previously described before booting the rescue media, which I'm normally able to do.

Like @Stigg, I bitlock nothing. Nor will I ever.

barreleye said:

While convenient, it seems to me that Macrium's rescue media "Automatically unlock BitLocker encrypted drives" option is like storing your Bitlocker keys on a post-it note wherever you keep your rescue media. If that's correct, I would not use it. I use Image For Windows (IFW), and it does not have such a feature. Instead, I suspend protection on the Windows 11 Pro system I want to restore before booting into the IFW rescue media, and then I can restore my system volume, which was imaged with the volume unlocked so in the plaintext state, such that it will be encrypted by Bitlocker on the fly, as it's being restored. This avoids needing to re-encrypt after rebooting and trashing the auto-unlock keys for my internal data and external backup drives, which are a hassle to get working again. I use a 1 TB internal drive as the primary storage for my images, so I normally suspend protection on both drives before booting the rescue media; there's a tutorial here that explains how to do that using manage-bde and PowerShell.

Note that I Bitlocker all my drives: system, internal data, and external data and backup drives. In the worst case, I boot into the rescue environment with all drives locked. Then I have to open a command shell and use manage-bde to unlock the drives I need to work with. It can be a challenge to match drive letters to locked volumes, because they're not the same as in normal Windows. That's why I set things up in Windows as previously described before booting the rescue media, which I'm normally able to do.

Click to expand...

forgive me for asking on an old thread, but I'm new at this and want to confirm that the following is correct, if I'm correctly following what you and others are saying

1) I can use either Macrium or IFW to image a Bitlocked drive onto external media that I have previously encrypted with Bitlocker to Go, by first suspending Bitlocker on both drives? I can make the image of my system volume *without* having to "turn off" (I guess this means decrypt) Bitlocker on my system volume?
2) Suspending rather than "turning off" Bitlocker saves me the trouble of having to decrypt and re-encrypt my whole drive and also saves me the trouble of having to a new key generated for the drive that I have to keep track of, is that right? I would really rather not have the stress of that if not needed.
3) The only issue is that when I go to restore the saved image, I will need to suspend Bitlocker again on the drives I'm restoring from and to? Can I first suspend Bitlocker on the external drive I am restoring from using some other computer, in lieu of using a command shell with a manage-bde command and having to keep guessing at drive letters until I get the correct one? and then boot the machine I am restoring to using separate unencrypted rescue media, to suspend Bitlocker on the internal drive I am restoring to by entering my saved key somehow?
4) The above will work as long as I am restoring to the same drive that was imaged from.

I'm asking since you use IFW and because the TeraByte Unlimited kb article on this topic (Using BitLocker with TeraByte’s Imaging Programs – TeraByte Knowledge Base) is really hard for me to follow and understand, and I'm not that familiar with how Bitlocker works. The TeraByte kb article suggests to me that if I restore a "type B" backup to a drive with different hardware than the original drive I may need to decrypt the whole drive I am restoring to anyway in order to be able to repair the installation and install the correct drivers for booting on that drive.

One last question: is it best practice or required to install the boot/rescue media on a separate, dedicated drive other than the drive I have backed up the images to? It seems like I should put the rescue media on an unencrypted drive? It is causing me consternation that I cannot readily find any explanation of this basic information anywhere. I'd be super grateful for enlightenment on the above.