Decrypting backups

[DanielJ]

I need to know what my options are here. Suppose a customer is offboarded and wants to take their GFS backups with them. The backups are encrypted with a password that I don't want to share with the customer. It's not very important that the backups are delivered encrypted since I can transfer them securely anyway, and then they are the customer's to worry about. How can I decrypt the backup files? If I export backups from them, the exported backups will also become encrypted as far as I know. They only method I can think of is to run instant recovery from all backups and create new backups from the published servers, which feels like a very roundabout way, particularly if it's more than a few servers/GFS points.

[IvanK]

Hi Daniel, before any suggestions, I'd like to clarify is this customer sending backups through Cloud Connect or it's a regular VBR install with a local repository and an offload to Capacity tier?
Also, is it a job settings encryption settings or repo encryption settings?

[DanielJ]

Regular VBR and no offloading. Job encryption.

[DanielJ]

Anyone?

[DanielJ]

I edit my question to: is there an inofficial, best-effort command line tool that can decrypt a VBK file given the password?

[Mildur]

Hi Daniel,

As far as I know, there isn’t such a tool. Once backup files are encrypted, they cannot simply be decrypted.

One possible approach you could try is using a backup copy job with a new encryption key and applying the registry setting to copy everything:

Code: Select all

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Veeam\Veeam Backup and Replication
Name: BackupCopyMirrorAll
Type: Multi-string value (REG_MULTI_SZ)
Data: <Name of the Backup Copy job>

Keep in mind that this key creates a single backup chain, meaning the oldest restore point will be a full backup file (vbk) and each GFS backup will be copied as an incremental backup file (vib).

Best,
Fabian

[DanielJ]

Thank you. The customer will need to have the GFS backups as standalone VBK files (losing block cloning savings is already accounted for). Then it looks like the only way is a therapeutic session of several instant recoveries -> new backups.

[DaStivi]

theoretically you could just restore the vm (disk/config) files, and potentially zip them again to save some space...
if you're talking about GFS, I guess its all Fulls?