BitLocker encryption for BackupAssist

How to install BitLocker

BitLocker is included as an installable feature in Window Server 2008R1/R2 and 2012R1/R2.

By default, BitLocker is not installed but it can be added from the Windows Server features list. Adding BitLocker will not encrypt any drives, it will just make BitLocker available as an option for BackupAssist System Protection backups.

After installing the BitLocker, Windows may require a restart before BitLocker can be used. If a reboot  is required, it will indicated at the end of the install operation.

To install BitLocker on Window Server 2012 / Server 2012 R2

1. Open Server Manager.
2. Select Add Roles and Features from the Manage menu.
3. Progress to the Features list under Select features.
4. Tick BitLocker Drive Encryption. Other roles and features required for Windows to use BitLocker will be automatically selected.
5. Select Add features.
6. Select next
7. Select Install.

To install BitLocker on Window Server 2008 / Server 2008 R2

1. Open Server Manager.
2. Select the Add features option from the Features Summary Help menu.
3. Tick BitLocker Drive Encryption
4. Select Install.

How to create a BitLocker backup job

This section explains how to create a backup job that uses BitLocker encryption.

Pre-requisites

• You must be using Windows Server for the BitLocker feature to appear.
• BitLocker must be installed, as explained in the previous section.
• Your backup destination must be an External drive or RDX drive.
• File Archiving also supports Flash drive destinations.
• A USB flash drive is required to store the encryption key.

A System Protection backup job implements BitLocker using 3 of the Backup job's set up steps.

1. Destination Media

This step is where you select Enable BitLocker encryption.

The Enable BitLocker encryption option will:

• Appear if you are running BackupAssist on a Windows Server
• Be selectable when you select a supported removable drive as a backup destination.
• Be greyed-out if BitLocker is not installed.


2. Set up destination


The following two fields are used to provide BitLocker configuration information.

• BitLocker encryption key location: this is used to identify the USB flash drive that the BitLocker encryption key is saved to. You can use the Detect option to identify the drive, or use the drop down list to select the Drive letter that has been allocated to the USB flash drive.
• Password for encrypted backup drive: this field is where you enter the password that can be used to manually unlock any drive that was encrypted by this backup job.
• Selecting Safely eject the hard drive after the backup has been completed, is a good way to lock the drive after the backup has been completed.


3. Prepare media


This step is used to prepare each of the drives that the backup job will use. By default, it will display drives based on the backup schedule. When you select the Prepare button next to each drive, that drive will be labeled by BackupAssist and selected for BitLocker encryption.

• The encryption process will not start until the backup job has been created.
• It is recommended that you prepare all of your drives so that they can be encrypted.
• If the required drive is not encrypted when the backup job runs, the backup job will fail.


4. Next Steps

This is the final screen in the backup job creation process, and comes after you have named the backup job. If you have selected BitLocker Encryption, there will be a tick box for - Launch BitLocker encryption tool.

When you select Finish, the backup job will be created and the BitLocker encryption tool will automatically start and begin encrypting the drives that you Prepared in the Prepare media step.

• When you select Finish, the backup job will be created and the BitLocker encryption tool will open.

• When you select the start icon next to a drive that you prepared, and the encryption process will begin.
• If you deselect this box, the drives will not be encrypted.
• If the backup job runs and its drive has not been encrypted, the backup job will fail.



During the encryption process, the drive’s encryption key is saved to the USB flash drive and the password is assigned to the drive. The key will be saved as a hidden system file.

If you want to prepare more drives after the encryption process has finished, you can as follows:

1. Select the Backup tab's Manage menu.
2. Select the backup job and select Edit from the lower menu.
3. Select Prepare media from the job menu.
4. Select Prepare for each drive that you want to encrypt.
5. Select the BitLocker encryption tool using the link inside the window.

The BitLocker Encryption tool will open and begin the encryption process.

The BitLocker encryption tool

The BitLocker encryption tool can run in the background after BackupAssist has been closed. The encryption process will tell you how much has been encrypted and how long the process will take.

You can encrypt more than one drive at a time, reducing the total time required to encrypt your set of prepared drives.


The encryption tool has 4 action buttons:

• Refresh and display any new drives that have been attached
• Start an encryption process that has been paused
• Pause the encryption process.
• Eject the removable drive. You cannot eject a drive that is being encrypted.


If you do not resume a paused encryption, the drive will be partially encrypted. A partially encrypted drive can still be accessed in Windows but it cannot be used as a backup destination for a BitLocker job. To decrypt the encrypted part of the drive, open BitLocker from the Windows Control Panel, select the drive and click Turn off BitLocker.
If you have previously encrypted a drive using the Windows BitLocker UI, you must unlock the drive before preparing (encrypting) the drive using BackupAssist.

How to restore & recover from an encrypted drive

When you perform a restore, you CAN use the password to unlock an encrypted drive. This will allow you to access the data as long as the password is the one that was assigned when the drive was encrypted. You will be prompted for the password when the restore job tries to access the backup.

For example, if you are using the BackupAssist Restore Console, you will be prompted to enter the password when you select Restore at the very last step.

When you perform a restore, you CAN use the encryption key to unlock an encrypted drive, by connecting the USB flash drive to the server running BackupAssist. BackupAssist will use the key to unlock the drive that you are restoring from. You will not be prompted to do anything other than the normal restore steps.

When you perform a recovery, you MUST use the password to access an encrypted drive. The RecoverAssist media will boot the system and ask for the location of the image backup that you want to recover from. When you select the encrypted drive, you will be prompted to enter the password.

Drive encryption duration

BitLocker encrypts the drive that the backup resides on at the sector level. This means you only need to encrypt the drive once, but because all the encryption takes place up front, it can take a long time.

Microsoft estimates that BitLocker encryption can take 1 minute per 500mb, so you should plan when to perform the encryption based on the information below.

How long the encryption process takes depends on:

• The size of the drive
• The performance of the drive and the server
• The operating system you are using
• How much data is on the drive (for Windows 2012)

If you are using Windows 8 or Windows Server 2012 and later, BitLocker will only encrypt the used space. It does not encrypt unused disk space or disk space containing deleted files. This makes the process very fast when there is not much data on the drive.

Encryption examples

The below table provides examples for how long the encryption process could take in different scenarios, using sensible estimates.

Windows Server 2008

Windows Server 2012

To learn more, see the Microsoft BitLocker FAQ.

Windows BitLocker Pop up message

When an encrypted drive is attached to a server that is logged on, Windows will display a pop-up message to tell you that the drive is available and a password is required to access it.

Having a USB drive with an encryption key means you do not need to respond to this prompt for your backup job to proceed.

This message will have no impact on your backup job. You do not need to enter the password as long as you have the USB flash drive with the encryption key attached.

The pop-up message response

Because this is a Windows security pop-up, and because it needs to be allowed to appear for encrypted drives that are not managed by BackupAssist, it’s important to understand how the message applies to BackupAssist.

• If you see this message, you can select Cancel and ignore it. Your backup job will not be affected because the encryption key will be used to unlock the drive.
• If you enter the password into the pop-up and tickAutomatically unlock on this computer from now on,the pop-up will not appear again. However, this means that the drive will be automatically unlocked every time it is attached. For security reasons, we recommended that you use the encryption key on the USB thumb drive to unlock the drive rather than have it auto unlock.
• Using the encryption key means the drive is only unlocked while the backup job is running. The key unlocks the drive when the backup starts and, if you have the drive set to eject, it will be locked again when the drive ejects at the end of the backup job.
• Using the password auto unlock means the drive will be unlocked for as long as it is attached to the server.