none
Capture BitLocker Encrypted Drive

    Question

  • Hi There.

    I want to capture a BitLocker encrypted Hard drive with multiple partitions. I have few questions.

    1. How can I use imagex to capture BitLocker encrypted partitions?

    2. How can I capture the hidden partition that is created for storing the Boot files?

    Any help would be much appreciated.

    Thank You,

    Sourav


    Born to Learn

    Wednesday, February 3, 2016 11:12 AM

Answers

  • Hi souravdgupta,

     

    Based on your description, First of all, we need to turn off BitLocker Drive Encryption before using imageX to capture BitLocker encrypted partitions. Please refer to the steps below.

     

    1.Click “Start”, click “Control Panel”, click “System and Security”, and then click “BitLocker Drive Encryption”.

    2.Find the drive on which you want BitLocker Drive Encryption turned off, and click “Turn Off BitLocker”.

    3.A message is displayed, informing you that the drive will be decrypted and that decryption may take some time. Click “Decrypt the drive” to continue and turn off BitLocker on the drive.

     

    Refer to the link:

    Turning Off BitLocker Drive Encryption (Windows 7): https://technet.microsoft.com/en-us/library/ee424315(v=ws.10).aspx

     

    The reason why we need to turn off Bitlocker drive encryption is before you capture the image, you need to perform sysprep first.

    Since sysprep will move the special feature of the image such as SID of hardware, however, the BitLocker Drive Encryption is based on your hardware. If you don’t turn off Bitlocker drive encryption before capture the image,  you will be not able to perform the operation.

     

    As soon as we turn off the BitLocker Drive Encryption, we may try to capture images of Hard Disk Partitions by using ImageX. Please refer to the link:

    Capture Images of Hard Disk Partitions by Using ImageX: https://technet.microsoft.com/en-us/library/dd744320(v=ws.10).aspx

     

    Best Regards,

    Tao


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Saturday, February 6, 2016 12:30 PM
    Moderator

All replies

  • You can use manage-bde and your recovery key to disable the encryption so you can capture it.

    https://technet.microsoft.com/en-us/library/ff829849.aspx

    If you want to make a copy of the disk without decryption, you can use a software program that is capable of doing a sector copy. For those, only if there are no bad sectors, otherwise you may want to use a hardware duplicator.

    Wednesday, February 3, 2016 7:08 PM
  • Hi souravdgupta,

     

    Based on your description, First of all, we need to turn off BitLocker Drive Encryption before using imageX to capture BitLocker encrypted partitions. Please refer to the steps below.

     

    1.Click “Start”, click “Control Panel”, click “System and Security”, and then click “BitLocker Drive Encryption”.

    2.Find the drive on which you want BitLocker Drive Encryption turned off, and click “Turn Off BitLocker”.

    3.A message is displayed, informing you that the drive will be decrypted and that decryption may take some time. Click “Decrypt the drive” to continue and turn off BitLocker on the drive.

     

    Refer to the link:

    Turning Off BitLocker Drive Encryption (Windows 7): https://technet.microsoft.com/en-us/library/ee424315(v=ws.10).aspx

     

    The reason why we need to turn off Bitlocker drive encryption is before you capture the image, you need to perform sysprep first.

    Since sysprep will move the special feature of the image such as SID of hardware, however, the BitLocker Drive Encryption is based on your hardware. If you don’t turn off Bitlocker drive encryption before capture the image,  you will be not able to perform the operation.

     

    As soon as we turn off the BitLocker Drive Encryption, we may try to capture images of Hard Disk Partitions by using ImageX. Please refer to the link:

    Capture Images of Hard Disk Partitions by Using ImageX: https://technet.microsoft.com/en-us/library/dd744320(v=ws.10).aspx

     

    Best Regards,

    Tao


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Saturday, February 6, 2016 12:30 PM
    Moderator
  • Tony, did you try this imagex process without undoing the bitlocker encryption, first? I don't think it will make any difference, because BL is transparent to the OS, imagex will not even know it is imaging a bitlocked drive.
    Saturday, February 6, 2016 1:17 PM
  • Hi,

    We haven’t heard from you in a couple of days, have you solved the problem? We are looking forward to your good news.

    Best Regards,

    Tao


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Tuesday, February 16, 2016 6:47 AM
    Moderator
  • Hi,

    I am going to capture a BitLocker encrypted partition with imagex.

    I will let you know the status.

    Thanks,

    Sourav


    Born to Learn

    Tuesday, February 16, 2016 10:16 AM