PGP Whole Disk Encryption (WDE) - how to image/backup the boot partition?

Question

On Windows 7, I would like to backup the system partition. The whole disk, including the partition, has just been encrypted with PGP 10.1.2 SP3 (I'm obliged to use precisely this software for encryption).

Features I'd like:

• low cost or free
• Windows 7 system partition still bootable after restore, or there is a predictable procedure to make it bootable again
• it does not matter if the backup is encrypted
• it does not matter if the filesystem stays encrypted after restore - I can afford to re-encrypt it later
• (preferably: backup done while Windows 7 is running)
• (perfect: use the Windows 7 native tool Control Panel -> Backup -> Create system image, I used that before PGP WDE)

Edit: I'm aware of this old recommendation from Symantec support and Casper Secure.

Answer 1

A free option always is using Parted Magic. A free linux distro meant specificly for any disk operation imaginable. It has partimage which allows disk image creation. Since the system will not be running booting from this disk when creating the backup it will not have any issues with files that are in use or denied access to.

Considering you mentioned the windows 7 native tool would be perfect and you don't care whether the backup or the restore are encrypted you should test it out. Yes I said testing, you can never be sure of your backup otherwise.

A range of alternatives is found here: http://www.techsupportalert.com/best-free-drive-imaging-program.htm

Answer 2

I don't believe that any other product than Casper Secure exists that has the same high level of integration with PGP WDE. Read below for free and maybe good-enough products.

A backup product that does raw (sector-by-sector) backup can also backup a PGP encrypted system partition, although only when booting from its own boot media which is an annoyance. Another disadvantage will be that it will need to copy every sector, because it cannot know which sectors of the encrypted disk are used and which are not, so the backup process will be much slower and the backup media much larger.

Most backup products that do file-copy using shadow copy can also work on the encrypted disk from within Windows. The disadvantage here is that the result is not encrypted, and once restored the disk will be unencrypted and not guaranteed to boot. Nevertheless, an emergency procedure will be to reformat the disk, restore the files using the boot CD that is part of the backup product, make it bootable by using the Windows Startup Repair, then re-encrypt. In the worst scenario, you will also need to reinstall Windows on the reformatted and empty disk before doing the restore from a boot CD.

For a plethora of good backup products of both kinds that you can try, see :

Best Free Drive Imaging Program
Best Free Backup Program

Once you decide on the product(s) you like best, you should also test the procedure of restoration, just in case, although restoring to a new disk is rather recommended.

Answer 3

TL;DR

Self answer: the PGP boot-time password screen executes from MBR, and not from any partition.

Windows native System Image - what didn't work

I booted from Windows System Repair CD and simply restored the system partition, not touching my data partition. On reboot the PGP password screen was still shown, and after accepting password it displayed "Missing operating system".

Chances are that fixMBR would allow the system to boot, but I didn't try it.

Windows native System Image - what did work

I booted from Windows System Repair CD and selected to "format and restore entire disk", despite the fact that image contained just a single boot partition and did not contain my data partition (D:). System booted successfully, both the system and data partitions had the proper size, but the data partition was re-formatted. I needed to restore it from separate backup. Obviously, both partitions were unencrypted, but there were no complaints or leftovers from PGP, and I've been able to re-encrypt whole disk back to original state. Success.

Casper Secure Drive Backup for PGP WDE (3.0.2216)

Surprisingly, the tool only allows partition-to-partition backup. This works (amazingly fast), and I've been able to boot from the copied partition even if it was on an external USB drive. Still, the partition-to-partition scheme becomes troublesome when you want to keep a number of previous backups. There is no sign of the partition-to-file mode.

Details

Lenovo T410, Windows 7 SP1 64-bit. The first disk partition 70 GB for system, the second some 230 GB for data, no "extended" partitions, no GPT, no dynamic volumes, no linux. Both partitions are encrypted with PGP 10.1.2 SP3.

Answer 4

To heck with restoration of a disc image, I personally prefer cloning. That way, right after the clone, I just reboot the computer, hit F11 and select the cloned disc to boot and voila, it's tested. I now have a full backup that I don't have to take time to restore.

Casper backup uses a Smartclone feature that does a very fast job of updating the clone. One caution: Make sure to disable the "USB Bootable" option in Casper if your clone doesn't boot.

One last item: Casper Secure Drive, now on version 4.5, has not ONE review that actually tested it. Supposedly, it can clone a Bitlocker or PGP encrypted disc, and the clone will also be encrypted!!! Norton, Easus, Macrium, Acronis, etc all can clone an an encrypted disc but ONLY if it's unlocked, and then the clone is not encrypted. Casper Secure Drive, at $129 (ouch) is the only one that can do this. Has ANYONE tested it? They have a trial download version.