locked
Best Encryption/Protection on Client HDs for WHS 2011 Backup/Restore? RRS feed

  • Question

  • I have been trying to figure out how to best keep a portion of my files encrypted, yet use the backup process from WHS 2011.  Here's a list of my options so far, and the pros/cons...problems I've had.  If anyone could offer a better solution, it would be much appreciated!  While writing this out, I started leaning toward option 3 if it will work...but I would still love to get thoughts from others who have wrestled with the combination of encryption, WHS, and backups.

    GOALS:

    1. Have important data (financial, etc.) be encrypted on the client computer...AND in the backups of the client files
    2. Use WHS 2011 daily backup process (I have easy solutions for using alternative backups, but all are manual...and I'd like the automated WHS 2011 backups to work
    3. Avoid encrypting the client or WHS system disk for performance reasons

    OPTIONS:

    1. BitLocker on an encrypted client partition that only gets manually unlocked when I need the secured data
      • Pros:
        • Built In to Win7
        • File names/structure also protected
      • Cons:
        • WHS backup "forgets" about the volume if it is not unlocked.  The backup process forgets permanently and will not attempt to backup even if the volume is unlocked at a later time
        • WHS copies are unencrypted unless I use BitLocker on the WHS machine.  Am considering it, but would prefer to avoid encrypting the whole system when I only care about certain files.
    2. TrueCrypt
      • Pros:
        • Well integrated into Windows client OSs
        • The backup itself would contain encrypted data so long as I only backup the volume file and not the files within a mounted volume
        • A TrueCrypt volume file can be backed up when not mounted, since I would have it reside in a normal file system
        • This scheme would still let me open the volume when the files are needed, rather than automatic at any bootup
      • Cons:
        • The TrueCrypt volume file might need to be backed up in its entirety, even with only a single small change in one file in the volume (not 100% sure on this, since I'm still not entirely sure how the WHS backup works on a file/block level)
        • May not be as resilient to HD crashes
    3. BitLocker on a VHD that is stored on a backed up filesystem
      • Pros:
        • Same as TrueCrypt...
      • Cons:
        • Performance?
        • Annoyance of having to mount and unlock each time?
    4. EFS for the files of interest
      • Pros:
        • Seamless use of the files on the client
        • By-File backup processing, since block-level changes are discrete to single files, even though encrypted
        • The backup files stay encrypted
        • I can assign a recovery cert
      • Cons:
        • The encrypted files can't be retrieved/restored directly from WHS without the certs attached to the original user account
        • The file names/structure are visible, even if they cannot be decrypted
        • I lose indexing for the encrypted files

    Thanks!

    Chaff
    Sunday, July 1, 2012 6:04 AM

Answers

  • Backing up any volume which needs to be mounted in order to access it's contents, and whose contents change regularly, is likely to result in a much larger backup database than you will like since, while Windows Home Server only backs up changed blocks of data (clusters), rather than entire changed files, all virtual drives need to undergo reorganization on a regular basis to prevent them growing unchecked, and to improve performance of the volume as well. This activity will normally result in large numbers of changed blocks, all of which will need to be backed up. Additionally, an encrypted volume backed up in toto exposes every file it contains to potential corruption if something happens to corrupt the container. Individual files could be individually corrupted, but it's possible that only some would be. (Note: given the relative fragility of the Windows Home Server backup database, this is something of a moot point; damage to a single component of the database can potentially result in the loss of the entire database. In my experience it's very rare for only a single file to be corrupted by a database error.)

    Also, one must remember that Windows Home Server doesn't explicitly support encryption; if a file can be backed up at all, it's backed up in whatever state Windows Home Server finds it in. For Bitlocker volumes, that's unencrypted, and the data in the backup database is also unencrypted. For EFS files, that state is "encrypted". For other encryption technologies, it will vary and you'll need to consult documentation and/or support for the encryption vendor for more information.

    Given all that, the recommendation is to not use encryption; every option available results in either no encryption in the backup database, or a significant chance of losing all encrypted data. If, for some reason, you must use encryption anyway, I would tend to recommend EFS (or any similar technology which results in storage of individual encrypted files), and keep multiple backups of certs, which you test frequently.


    I'm not on the WHS team, I just post a lot. :)

    • Marked as answer by Social Chaff Tuesday, July 3, 2012 1:40 AM
    Sunday, July 1, 2012 1:06 PM