Two of your favorite themes are image backup and TrueCrypt. I’ve not seen
you write about the two together. I’ve bought an eSata 1TB drive and I’m
planning to put TrueCrypt on it and then back up my Vista system and files
before upgrading to Windows 7. How does that sound to you?
Sounds just fine, but my initial reaction is – why?
Not that there aren’t valid reasons for doing do, but by and large it’s not
something most people need. That being said, it is a good solution for certain
scenarios, and I’ll look at a couple.
It all does kind of beg a chicken-and-egg type of question: do you backup
encrypted files, or do you encrypt the backup?
]]>
The purpose of encryption is simple: security. More specifically, encryption prevents unauthorized people from accessing your sensitive data. As you mentioned, TrueCrypt is my bulk encryption solution of choice. I rely on it heavily.
Backing up, of course, is all about recovering from failure and data loss. If your hard drive dies or if you accidentally delete a file having a recent full backup of your system that you can rely on for recovery will ultimately save the day.
So, why encrypt a backup?
In short: you’d want to encrypt your backup if for some reason it could fall into the hands of people whom you’d not want to be able to see its contents.
In most cases, that’s actually not necessary. For example, many people perform their backups to an external drive sitting right next to their machine. There’s no reason to encrypt the backup if the machine right next to it isn’t encrypted itself. Encrypting the backup gives you no real additional protection.
Except…
The most common scenario that people consider in a situation like this is theft. A knowledgeable thief who’s actually after your data may well steal only the external drive. If the backup data on that drive is encrypted it’s of no use to him.
That’s if he’s actually after your data. I’m of the opinion that thieves are actually more likely to steal computers and other higher value electronics rather than today’s inexpensive external drives.
Needless to say, I don’t encrypt my external drives or my daily backups.
On the other hand, if theft of the external drive is a real concern, or you do plan to take that external drive to less secure location – perhaps for off-site backup – then encrypting it using a tool like TrueCrypt is perfect approach.
But we’re not done encrypting backups just yet. 
As I said above, I figure that it’s my PC that’s more likely to be stolen than some random external drive. Or even more likely, my laptop could easily disappear since it’s designed to be portable and easy to carry off.
And of course, the data on either of those computers – desktop or laptop – would go along with it.
That’s why I encrypt my sensitive data regardless of what computer it’s on.
My Roboform password database, my financial records and more all reside in a TrueCrypt volume for which I must provide the passphrase in order to access.
And when it comes to backup, here’s the key: I don’t backup the contents of the TrueCrypt containers – I backup the containers themselves. That means that my backups are just as secure as the files on my computer. It means that in order to access any of that information – even from my backups – the correct passphrase is required.
All of this is done with no additional effort on my part when it comes to the backup. I don’t encrypt my backups – I backup my already encrypted files.
And it also means I don’t use whole-disk encryption – I use standard TrueCrypt volumes as files, specifically so that they can be backed up and copied around as needed.
Ultimately, exactly what combination of encryption and backup technologies you would use will depend on your specific needs and situations. Whether you encrypt your backup, or back up your encrypted data – or whether you do anything additional at all – TrueCrypt and your backup strategy can absolutely play well together.
I shall tell you a terrible and true tale about
encrypting backups.
Three years ago I went on a trip, leaving my Turkish wife at home in Turkey with her family. Her niece dug out a back-up disk of my emails and went through ten years of emails looking for incriminating evidence. Her English
is good, but not great. They found three apparently suspicious emails from which my wife went berserk., led on by her mad, fat sister (aka The Mad Cow). I am divorced at age 63 because I did not encrypt non-incriminating, innocent
emails from my wife. Go figure.
Thanks,
Truecrypt warns that users should NEVER create volumes/backup volumes by copying the container file.
Apparently, since the two volumes use the same master key, it “aids cryptanalysis”
” Never create a new TrueCrypt volume by cloning an existing TrueCrypt volume. Always use the TrueCrypt Volume Creation Wizard to create a new TrueCrypt volume. If you clone a volume and then start using both this volume and its clone in a way that both eventually contain different data, then you might aid cryptanalysis (both volumes will share a single key set). This is especially critical when the volume contains a hidden volume. See also the chapter How to Back Up Securely.”
30-Nov-2009
Note that most drive imaging packages, including Acronis and Symantec, have the ability to encrypt their backups. You only need to encrypt the stuff that your imaging software doesn’t take care of.
I have been creating clones of my TrueCrypt volumes, as I don’t seem to be able to create virtual drive “W” and virtual drive “X”. Every time I create a TrueCrypt volume, it uses the same drive “number” as before, so I can never have two TrueCrypt volumes at the same time. What am I doing wrong?
Peter
03-Dec-2009
One thing to remember about TrueCrypt and backups is that TrueCrypt does not update the date modified or date accessed information in Windows. Therefore, if you add files to your TrueCrypt volume today, your incremental backup for today that runs tonight will not back up the TrueCrypt volume because the system does not think the file containing the volume has changed. The only way around this is to force these files to be copied to a backup every time your incremental backups run. (This might have to be a separate backup job.) Full backups are OK because these backups will get all of your files including the TrueCrypt volumes.
Peter M.
The reason this option defaults to on is that if the container’s timestamp is five years old (or whatever) it gives no indication that the data within it was updated yesterday, securing any traces of usage.
And yes, I learned this the hard way when my TrueCrypt volume didn’t back up as expected some years ago.
03-Dec-2009
personally, I’d encrypt even encrypted stuff (and then even encrypt that)
seriously, though
Until Acronis 2010, encryption was not possible; it was only password protected, and the password protection was not strong
truecrypt volumes – I put some of those into DROPBOX (a shared cloud system between computers) – and If I entered stuff into that truecrypt volume, that volume, upon dismounting, would update to the other machines, so it must be reading the date/time somehow
I have my hard drive encrypted (tablet PC). I then do a backup of it, through windows, with acronis. This creates an UNENCRYPTEd backup of actual partitions, that can be loaded back in a RESTORE operation, to a new hard drive. BUT, since unencrypted, they possibly should be stored in an encrypted external drive.
BUT, acronis version 2010 has encryption, BUT that version is not too reliable, from reading their forum, and from my personal install experience
to ALL of you, you are ALL doing much more than your insurance companies . Blue Cross Blue Shield lost ANOTHER laptop, UNENCRYPTED, with names/socialsecurity numbers/PROVIDER numbers, of over 850,000 physicians on it. This is ludicrous, when programs such as truecrypt are available for FREE, and good paid programs such as SecureDoc exist, for just over $100.00 per machine
Create encrypted backup volumes with a different password, large enough for the volumes you want to back up. Mount your primary, mount your backup volume, and use a synchronization app e.g. Syncback on Windows or Chronosync on MacOSX to sync from the unencrypted innards of your primary volume to it’s dedicated backup volume. Then unmount them. This way they both stay encrypted, you’re not aiding any cryptanalysis because both are different volumes, and you gain the major advantage of being able to use incremental compare/sync tools like I mention, as opposed to copying an entire volume to a backup every time you change one line in a single document :)