Veeam Endpoint Backup and Truecrypt

[jeancharles]

Maybe we should have it as a new feature request : pre/post tasks to backups, to automate dismounting/changing time of TC container, and after backup launched remount TC container.

[csarli]

I was already requested.. http://forums.veeam.com/veeam-endpoint- ... 25410.html

[Njumaen]

Good News Everyone!

I managed to restore a Windows7 64-bit VM (Fusion) with a full encrypted TC 7.1a drive backed up with latest VEB with no problems at all!

File level restore works as well running the encrypted VM.

For sure, the patition is fully decrypted after bare metal restore! You should encrypt again. VEB feature request: password protected backups !

I'll try VeraCrypt https://veracrypt.codeplex.com (OSS successor of TC) and a physical machine next.

@veeam: VEB ist the best stuff since sliced bread!

Ralf.

[Dima P.]

Ralf,
Thanks for sharing and yes, your feature request counted!

[Njumaen]

Update: Restore of a veracrypted disk (Win8.1x64, physical) to a blank disk worked as well! Don't forget to encrypt again!

Ralf.

[SJOHANS]

All my sensitive data is stored in a large Truecrypt container which has to be mounted after every system start. After mounting the container via Truecrypt, I can access my data via the assigned volume letter, so for the Windows 10 file system it appears as additional volume (e.g. d:\).
Now I want to define the files on the mounted container as backup target, but under Veeam Endpoint Backup (1.1.1.212), the mounted container does not appear in the volume list where I can define the backup targets.

Is there any possibility to backup the data on file level without backing up the entire container?

[Dima P.]

Hello,

Is there any possibility to backup the data on file level without backing up the entire container?

I believe it is possible only via volume level backup or via entire pc backup.

[SJOHANS]

volume level backup doesn´t work as well, because the volume (mounted truecrypt container) does not appear in the volume list (where I define the volumes which should be backed up).

[SaschaH]

Hi,

yes, iirc you can not backup from or even to a TC container - no matter how it's mounted. Backups from a encrypted system drive will work, though.
I'd really appreciate seeing that function in a future version!

EDIT: please be aware that backups from an encrypted system disk will be decrypted during the backup!

Sascha

[Dima P.]

Hello Sascha,

I finally found the discussions regarding the TrueCrypt volumes. Kindly, take a look and let me know if it helps. Thank you.

[matrixrich]

I can confirm that file level restore w/ VEB works fine on my BitLocker encrypted drive.

[Wondering]

After having tried Acronis and Paragon backup products I was excited to get to Veeam after I read a lot of good recommendations for it.
Unfortunately I cannot create a backup to my external USB hard drive, because it's encrypted with TrueCrypt. Although it's properly mounted and visible as a drive in the Explorer, it's not shown in Veeam as a target location and manually entering the path simply results in an error (Specify target folder). I have never come across a software that didn't recognize the mounted drive as a normal drive / folder location. Even your competitos showed this as a normal location. Also from a technical point of view I don't see any reason why the TARGET backup location may not be a mounted TrueCrypt drive. There seems to be some kind of check in your software that fails on that drive. This check needs to be adjusted, so backups can be created there as well.

[Dima P.]

Hi Wondering,

If you TrueCrypted device is properly mounted and unlocked, it should be visible. Please open a support case and let our team investigate it. Thanks.

[Wondering]

You imply that there's a "unproper" way to mount a TC device. What would that be?
The mounted device shows up as a normal hard drive in the Explorer and is accessable through all applications except for Veeam.
Where do you want me to submit a support case? I saw a possibility through the application itself, but it'd send system data with it that I don't see the content of. For me this is a privacy no-go, I'm afraid. Nevertheless, I don't think this is a special problem for my case as it's a pretty basic setup. I'm sure this can easily be reproduced using the same command line to mount a test device:

Code: Select all

TrueCrypt.exe /q /a devices /lX /p "password"

Could you please create a support case for it or tell me another way to send it? On your website I only see "two paid support programs".

[Dima P.]

The only way to open a support case is thru the Control Panel, indeed. Yes, VEB debug logs are automatically assigned but that is the only information we need for troubleshooting purposes.

By the way, have you seen this workaround shared earlier in this thread?

... if you want to put backup TO TrueCrypt volume you have to create in TC volume directory and share it (in permission you have to add SYSTEM) in VEB you have to choose as a destination network location and set shared folder from TC volume...

[Wondering]

I've tried the workaround and it worked with the initial backup, but fails with the incremental backups (Error: Shared memory connection was closed. Failed to upload disk. Agent failed to process method {DataTransfer.SyncDisk}). Whatever this error means I don't think it's worth analyzing it because the main problem is the first issue. It also feels wrong having to use a shared folder for backups just because the backup software doesn't see a mounted drive.

Dima, could you please manually create a support case for that? I'm sure this isn't related to my system, so there's no need to send system data in a blackbox. You shouldn't request getting information from users systems without them knowing what's inside anyway. At least show the collected information before sending it.

The TrueCrypt drive (not container!) is mounted via "Select Device" > "Mount". So nothing special here.

[Dima P.]

Hi Wondering,

I am sorry but I can’t - support cases can be opened only via VEB’s Control Panel. I wanted to ask our QA to look into your particular issue, but generally, we do not support TrueCrypt solution as a source and as a target (moreover, it looks like it’s no longer supported by its vendor).

Instead, we have a complete compatibility with MS BitLocker. It can be used as a backup destination, as a source for backup and is fully restorable. Thanks.

[Wondering]

It's probably the wrong place to discuss whether to use Bitlocker or TrueCrypt, so I'm skipping my comment on this.

Instead I'd like to point out that a mounted TrueCrypt container or partition is treated as a normal drive in Windows. In all these years I have never ever come across a software that didn't see the mounted drive (including many different backup software products). Veeam is the very first one and this actually makes me wonder. There is absolutely no technical reason for not being able to write to that drive (it's just a normal Windows drive/folder!). The only reason I see is that the drive is hidden/blocked on purpose by Veeam. I consider this problematic in terms of trustworthiness. Why would you block TrueCrypt on purpose while at the same time advertising BitLocker? This is something to think about for a minute.

Three weeks ago I've been at a fair where I had a nice chat with your team at your exhibition booth there. I'm actually in the process of pushing your server backup solutions for consideration in our company. This topic here however is for my private use (also a result of that chat). The very first contact with your product results in a technical problem (not good, but acceptable if it can be resolved). However, trying to find a solution for this leads to the first trust-problem where you require private system data to be sent in a blackbox to you to file an issue report, and a second trust-problem where you assumingly on purpose disallow TrueCrypt use.

I'm afraid, but one of the most important things for a company that deals with user data is trust. Users need to trust you to get your hands on their data. My first experience with your software shows everything but trustability. This is really a pity as it's in contrast to my reasons for using your software in our company. I'm afraid but I'm going to have to withdraw or at least freeze my recommendation for using your software.

[Dima P.]

Wondering,

it's just a normal Windows drive/folder!

TrueCrypt software mounts encrypted container to the OS - that’s true. However, it does not make this container a usual volume/folder since the mount process is controlled by TrueCrypt software (or I am missing something?)

Why would you block TrueCrypt on purpose while at the same time advertising BitLocker?

We never blocked USB devices of any kind. I bet the flash drive you used to store a TrueCrypt container is visible in the VEB job’s destination step. Regarding the mount issues or the error you posted while backing up to encrypted container, I’ve asked you for the logs and the support case in my first post to start the investigation.

second trust-problem where you assumingly on purpose disallow TrueCrypt use

This thread contains several reports from other community members are successfully using TrueCrypt files as a source or as a destination.

require private system data to be sent in a blackbox to you to file an issue report

You can check the debug logs (C:\ProgramData\Veeam) on your own to make sure they don’t contain personal information of any kind. If you are uncomfortable with sending the very same folder to support team via VEB’s UI, share it with me via any available could hosting (dropbox/google drive or any other works) - I am here to help.

one of the most important things for a company that deals with user data is trust.

While I strongly agree with you on this one, I am still quite surprised that you do trust to the software which support was dropped by it’s own vendor two years ago.

[Wondering]

I am still quite surprised that you do trust to the software which support was dropped by it’s own vendor two years ago.

Frankly, I don't understand why you continue to pick on TC. This topic isn't about whether to use TC or not. I could write a long text about why your recommendation to use Bitlocker is highly unreasonable and why TrueCrypt is the only secure solution to use today. But this isn't my goal here and it wouldn't change anything about the problem. But if you insist, let me answer briefly: TC is Open Source with several intense code reviews. I too had a look through the code to get my own picture about a couple of things. Mind, if I have a look at your source code, too?

We never blocked USB devices of any kind.

This statement doesn't have anything to do with the my question, because a mounted TC container is not a USB device.

I bet the flash drive you used to store a TrueCrypt container is visible in the VEB job’s destination step.

This also has nothing to do with my problem. Please read my postings again. I'm not mounting a flash drive nor am I mounting a TC container.

I’ve asked you for the logs and the support case in my first post to start the investigation. […]If you are uncomfortable with sending the very same folder to support team via VEB’s UI, share it with me via any available could hosting (dropbox/google drive or any other works) - I am here to help.

You’re turning the situation upside down: The logs are not relevant for this situation. I wanted to submit a technical issue ticket without sending any logs. Now you’re suggesting to send you the logs without submitting a ticket.

This thread contains several reports from other community members are successfully using TrueCrypt files as a source or as a destination.

Please show me those postings. I only read several messages saying it’s not possible to backup to a TC target.
But again: Nobody is requesting you to create special TC functionality or compatibility. The request is simply to backup to any folder that is accessible in Windows, like all other applications do as well.

[Jan1]

Hi,

I am an enthusiast TC. But as I remember TC has some vulnerabilities (even escalate permissions).
Most reasonable is use Veracrypt. But I am not expert in encryption and software security. I use TC but I think to migrate to VC.
I hope some day VEB will support external drivers as a source of backup. In TC you can mount container as USB drive I hope it will help.

BTW
Some time ago I discovered:

If you want to put backup TO TrueCrypt volume you have to create in TC volume directory and share it (in permission you have to add SYSTEM) in VEB you have to choose as a destination network location and set shared folder from TC volume.

Jan

[Dima P.]

Thanks Jan!

We had a conversation with our DEVs regarding this thread. On a local storage destination step, we allow to pick a volume that is physically presented to the operating system (so, it would work with a regular volume residing the hard disk or removable storage only).

First possible workaround is, indeed, to use a shared folder destination and point the backup job to the container of any kind via administrative share. Another option for the local storage destination step is to use symlink. Mount the TrueCrypt container as a regular folder underneath a volume that resides physical disk, and then choose this folder, as a backup destination and it should do the trick.

[Michel83]

Any news to that case? I have a mounted VeraCrypt file as drive "V:" and can't see this drive in Veeam. Is there any workaround?

[Dima P.]

Hi Michel83,

use a shared folder destination and point the backup job to the container of any kind via administrative share. Another option for the local storage destination step is to use symlink

Does that work in your case with VeraCrypt? Thanks.

[mensa]

Hello,

I am interested in backing up an encrypted PC (Encrypted System Partition by VeraCrypt).
So for backup the PC must be turned on (bott password entered) and the data is encrypted at runtime, that Windows can be loaded. I am wondering about the backup now.
If anyone steals the backup files, would the one be able to restore and run that backup on any other PC?
I think one should could get only until that point, where you have to enter the boot password.

But what's about extracting files from the Veeam backup files? Is that possible?
I think because the backed up data was not encrypted at the time of backup (system booted into Windows), maybe the whole backup is not encrypted by VeraCrypt and files can be extraced easily. What do you think?

[vClintWyckoff]

Mensa-
Check this thread out.

[Dima P.]

So for backup the PC must be turned on (bott password entered) and the data is encrypted at runtime, that Windows can be loaded. I am wondering about the backup now.
If anyone steals the backup files, would the one be able to restore and run that backup on any other PC?

If the volume is unlocked Veeam Agent backs it up as a regular non-encrypted partition.

But what's about extracting files from the Veeam backup files? Is that possible?

Only by performing a recovery.

I think because the backed up data was not encrypted at the time of backup (system booted into Windows), maybe the whole backup is not encrypted by VeraCrypt and files can be extraced easily. What do you think?

Correct. If you want to keep your backup file protected it's highly recommended to enable backup files encryption (it's available in all versions including free edition)

[xgRAHWhQ54]

I can back up TO a Veracrypt drive by mapping a symbolic link as described here:
https://forums.veeam.com/veeam-agent-fo ... ml#p188872

But I cannot back up the data from a mounted Veracrypt drive unless it's the system drive. Veeam Agent does not see the drive letters at all. It can back up the raw data from the hard drives but this is a huge waste of file space. Any workaround for this?

[Dima P.]

Hello xgRAHWhQ54.

Unfortunately there is no workaround, as we do not provide integration with Veracrypt on the application level. The only way is to backup entire crypto container from the disk as a file. Thanks!

[Borg]

After reading all this, the situation still remains relatively unclear.

1. If we want to save to a TrueCrypt or VeraCrypt Volume/container, can we do this or not ?
Please stop mentioning Bitlocker. It's considered untrusted my many communities.

2. Can we use instant recovery from a mounted container ?