Which backup strategy for encrypted Windows?

Hi everyone.
As mentioned in the subject, I have a Windows 11 system encrypted with BitLocker.
What is the best software for backing up and restoring an encrypted system? Would you clone the entire system or just the partition, or could the encryption cause issues during restoration?

I don't have experience using bitlocker, but here is the macrium reflect knowledge base article on it.

Technically, there should be no difference between backing up an encrypted system and a non-encrypted system with one footnote. Let me explain...

Let's start with a question: What do you do differently to access your files on an encrypted system? Answer: Nothing. This is because once you are signed in and the drive is unlocked, Windows automatically decrypts files as you access them on the fly without you doing a thing. This is no different with a backup. As the backup program reads data from the disk, Windows automagically decrypts the data. As a result, your backup manages to save your data but does so unencrypted, that is unless you instruct the backup program to apply its own encryption as it saves the backup.

Here is the footnote: Some backup programs, such as Macrium Reflect, do have the ability to backup encrypted data. The result is that you can restore data with encryption in place. Note that this is only useful if you restore the entire drive. If you restore just some data to a system with Bitlocker, that data gets automatically re-encrypted when it is restored to the disk that has Bitlocker enabled.

In my case, if I restore a whole drive, I simply re-enable BitLocker after the restore so I could care less if the backup program preserves BitLocker info.

I hope that all this makes sense. Please feel free to ask more questions if anything is not clear.

The imaging software I use recommends turning off Bitlocker before doing backups, moves, and restores...then re-enabling it after rebooting from the restore.

Drive images should be stored offline on removable media, and only online during imaging operations.

Banjoman301 said:

The imaging software I use recommends turning off Bitlocker before doing backups, moves, and restores...then re-enabling it after rebooting from the restore.

Click to expand...

That must be an incredibly poor backup program. A program written that poorly would never be taken seriously by me.

hsehestedt said:

That must be an incredibly poor backup program. A program written that poorly would never be taken seriously by me.

Click to expand...

I can't take your comment seriously...depends on what you're doing -


We don't do Hot Backups.

I have never understand why home-users encrypt the Operating system.. Data partitions i understand and recommend if they store sensitive data.. but i will never encrypt my system-drive as it has no real meaning... more then it actually slows down the drive.

It would be helpful to know what backup program the OP is referring to.

Banjoman301 said:

I can't take your comment seriously...depends on what you're doing -

Action	What to do with BitLocker	Why?
Hot Backups (while Windows is running)	Leave it ON	Most modern imaging software can back up a live, unlocked BitLocker drive from within Windows without any issues.
Cold Backups / Restores (requiring a reboot)	Suspend BitLocker	Suspending it keeps the data encrypted but leaves the "key" unencrypted on the drive temporarily. This allows the software's recovery environment to access the disk on reboot. It automatically re-engages when Windows boots back up.
Drive Moves / Resizing	Turn OFF (Decrypt)	If you are physically moving the drive to a different computer or changing partition sizes, it is safest to fully turn BitLocker off to prevent losing access to your data.

We don't do Hot Backups.

Click to expand...

Well, my comments were entirely about hot backups, the way the typical home user would do it. It should be intuitively obvious that a cold backup is a completely different story.

Marie SWE said:

I have never understand why home-users encrypt the Operating system.. Data partitions i understand and recommend if they store sensitive data.. but i will never encrypt my system-drive as it has no real meaning... more then it actually slows down the drive.

Click to expand...

My Windows drive is also my data drive on any laptop that has only a single drive. By encrypting that drive, I solve the problem of having to worry about placing data elsewhere. Plus, BitLocker has been 100% reliable for me and I use it on every single machine without exception so that's a lot of real world use giving me confidence in it.

But I agree with this - if you have nothing to protect, then don't use it. No need to add complexity unnecessarily. But I also suspect that the fear of it is simple ignorance by some people who simply refuse to educate themselves on it. That may just be a small number of people, but from erroneous comments and assumptiuons that some make about BitLocker it is clear that this is at least part of the problem.

A few simple minutes researech and a quick test or two on a VM would dispell a lot of the nonsense FUD surrounding this topic.

hsehestedt said:

My Windows drive is also my data drive on any laptop that has only a single drive. By encrypting that drive, I solve the problem of having to worry about placing data elsewhere. Plus, BitLocker has been 100% reliable for me and I use it on every single machine without exception so that's a lot of real world use giving me confidence in it.

But I agree with this - if you have nothing to protect, then don't use it. No need to add complexity unnecessarily. But I also suspect that the fear of it is simple ignorance by some people who simply refuse to educate themselves on it. That may just be a small number of people, but from erroneous comments and assumptiuons that some make about BitLocker it is clear that this is at least part of the problem.

A few simple minutes researech and a quick test or two on a VM would dispell a lot of the nonsense FUD surrounding this topic.

Click to expand...

Same here, i also have laptops with a single drive, but i don't encrypt my system partition to gain a bit of speed. and I'm not as other people, as i have absolutely no sensitive data or even personal data on my system drive that would make me nervous if it got in the wrong-wrong-wrong hands..(read the worst-hacker-ever-born)
My real sensitive data as work, legal documents etc, i never store that on a laptop. Its to easy to just grab and run.

As for FUD....... I'm not FUD.......I promise I'm absolutely not FUD.......... I'm totally freaking darn paranoid, after i started down the rabbit hole of ethical hacking 2 years ago. *LOL*