Best practices for backing up encrypted files and volumes

CrashPlan supports backing up encrypted files, folders, drives, and file systems operating at either the system or user level. This article outlines key compatibility requirements, configuration best practices, and expected restore behaviors across common encryption technologies.

Full disk and volume encryption

Full-disk encryption protects data at the volume or hardware level. Once the operating system boots and unlocks the volume, CrashPlan can read and back up the files.

BitLocker (Windows)

• Compatibility: Supported for both Installed for Everyone and Installed Per User deployment types.

• Backup behavior: Backs up files normally while the drive is unlocked and mounted.

• Restore behavior: Restores the standard, unencrypted files.

• Key consideration: If the drive is locked or unmounted, CrashPlan cannot access files and may report the drive as Missing when reviewing the file selection.

FileVault (macOS)

• Compatibility: Supported for both Installed for Everyone and Installed Per User deployment types.

• Backup behavior: Backs up files normally once the operating system boots and unlocks the startup volume.

• Restore behavior: Restores the standard, unencrypted files.

• Key consideration: No special app configuration is required.

User and file-system encryption

File-system level encryption ties access permissions directly to individual user accounts, security keys, and digital certificates.

Windows Encrypting File System (EFS)

• Compatibility: Requires CrashPlan to be Installed Per User. Deployments configured as Installed for Everyone are incompatible.

• Backup behavior: Runs within the active user session, granting CrashPlan access to decrypt and read the user's encrypted files.

• Restore behavior: Restores the standard, unencrypted files.

• Key consideration: An Installed for Everyone deployment will report backup failures for EFS-encrypted files, which may prevent backup status from reaching 100% completion and trigger alerts.

Encrypted containers and virtual disks

File containers encapsulate multiple files within a single host container file stored on disk.

File containers (e.g., VeraCrypt)

• Compatibility: Supported for both Installed for Everyone and Installed Per User deployment types.

• Backup behavior: Backs up changed container files by monitoring the host file's last modified timestamp.

• Restore behavior: Restores the encrypted container file. The original software and/or encryption key is required to access its contents.

• Key consideration:

  • Timestamp: Ensure the Last Modified timestamp of containers update in response to changes. CrashPlan cannot detect changes to the file and will not back up new data if the file's timestamps are kept static or preserved.

  • File size overhead: Container files can get very large. Modifying even a single file inside a vault requires CrashPlan to backup and deduplicate the entire file, which can significantly complicate and slow down backup and restore performance.