File level restore in VBR 9.5 Server 2008 R2 with bit locker Encryption

[govi]

Hi Team,

Recently we have enabled bit locker encryption on Windows Server 2008 R2 VM (Vmware) and I have found that when i try to do file level restore, I am unable to see encrypted drive in restore console. I have raised this case with Veeam Support(Case # 03295124) as per support due to bit locker Encryption VBR unable to decrypt the drive and populate the files.

Strange thing is that Veeam Windows Agent can restore files even Drives are encrypted. bit disappointing that VBR cannot do the job but windows agent can do the same job on Windows Server 2008 R2.

As per support, they suggested me to install windows agent when there is already VBR which takes care of backup. Installing agent on all the server and doing backup is going to take extra space on my backup repository and put extra pressure on system resources. Since I am doing normal backup of VM then agent backup of same files (Since we are not able to restore individual files) and then backup copy job using cloud connect.

Just trying to understand why agent can do the restore job but VBR cannot do the same job. What is the difference. Do we expect anything in next update which will enable to do restore the encrypted drive similar way agent does it?


Thanks,
Govi

[Andreas Neufert]

The two solution work on different levels within and outside of the operating system.

For the VM backup we mount the VM disks from backup to the Veeam console and Veeam mount server, the wizard access the files from there and restore them to the original server.
In case of bitlocker the data within the disk is encrypted and the File level recovery wizard can not access the data.

Potentially you can start the file level recovery and then take some action on windows to hand over the encryption key and access the data.

For sure there is OnDemand labs with SureBackup where you can start the VM in a lab (full OS boot in a network sandbox) and you can copy the files from there with windows. Please check with SureBackup documentation if you want to try it: https://helpcenter.veeam.com/docs/backu ... tml?ver=95

[govi]

Hi,

Thanks. Currently we are using standard license and sureBackup is available only in Enterprise and Enterprise Plus version and we don't have budget to upgrade it since we got only 2 socket on server and I dint we don't need other functionality which is available in Enterprise license.

can you please elaborate more below more.

Potentially you can start the file level recovery and then take some action on windows to hand over the encryption key and access the data.

Thanks,

Govi

[Andreas Neufert]

The idea is to start the Windows File Level Recovery wizard from the VM.

This should add a disk to the server where you start the console. The FLR wizard will not show any data.
Then check with the Bitlocker tool (of cause you need to install it before all this) to add the encryption key for it.
This should make the data readable and you can acceess them under c:\VeeamFLR to copy them form there.

I never have done this and there is a chance that this will not work or produce errors, but I think it is worth to test it as the Virtual Lab is no option for you.

If you search on google you will potentiall find additional helpful information.