This document describes how StateWarden backs up and restores volumes protected by full-disk encryption: Microsoft BitLocker on Windows and LUKS on Linux.
1. How StateWarden Handles Encrypted Volumes
StateWarden backs up encrypted volumes as raw encrypted containers, at the block level. The Agent reads the partition that holds the encrypted data (e.g., the BitLocker-protected C: partition or a crypto_LUKS partition) - not the decrypted view exposed by the operating system.
The Dashboard identifies these volumes with a warning badge (BitLocker / crypto_LUKS) and an "Encrypted Volume Detected" notice.
Consequences for Backups
Raw encrypted data is high-entropy, which has direct mechanical consequences:
- No deduplication and minimal compression: encrypted blocks contain no recognizable patterns, so deduplication cannot reduce them.
- No incremental backups (CBT ineffective): changing a single file rewrites its entire encrypted block area in a non-predictable way. Backups of encrypted volumes are therefore treated as Synthetic Full backups - every run reads the full volume.
Plan backup windows, retention, and storage quotas accordingly.
Security Properties
The backup stored in the vault remains protected by two independent layers:
- Inner layer: your original BitLocker/LUKS volume encryption.
- Outer layer: StateWarden's standard backup encryption (Zero-Knowledge architecture), applied to every backup regardless of source.
A copy of the backup is useless without your original volume passphrase, TPM protector, or recovery key.
Note: StateWarden deliberately backs up the encrypted container rather than the decrypted mapper view (e.g., /dev/mapper/cryptroot). A backup taken from the decrypted view would restore as an unencrypted volume, silently dropping your full-disk encryption. This is not the supported procedure.
2. Restoration Rules
Because backups contain the raw encrypted container, restores are block-for-block copies. There is no decrypt/re-encrypt conflict during the write process:
- The restored volume comes back exactly as it was at backup time - still encrypted, with the original LUKS header or BitLocker metadata intact.
- No special preparation of the target disk's encryption state is required. In particular, you do not need to disable or remove encryption on the target before restoring; the restore overwrites the target with the original encrypted blocks.
- After the restore, unlock the volume with its original credentials: the LUKS passphrase, or the BitLocker protector (TPM, password, or recovery key) that was in place when the backup was taken.
Hardware Changes and TPM-Bound BitLocker
If you restore to different hardware (a replacement motherboard or a new machine), a TPM-bound BitLocker volume will not unseal automatically, because the new TPM does not hold the original keys. Keep the BitLocker Recovery Key for the volume available; Windows will ask for it on first boot. LUKS volumes are unaffected by hardware changes, as they are unlocked by passphrase or keyfile only.
3. Step-by-Step Procedure
- Prepare the target: For Bare Metal Recovery, boot the blank machine from the Recovery ISO (see the Bare Metal Recovery Walkthrough). For an in-place restore, ensure the target disk or partition is at least as large as the source. No changes to the target's encryption configuration are needed.
- Initiate the restore: Open Restore Data (
/restore) in the Dashboard, locate the backup of the encrypted volume, and start the restore as with any other backup. For BMR, generate a BMR token and authenticate the Recovery ISO with it. - Wait for completion: The Agent writes the raw blocks back (skipping unallocated space where possible).
- Unlock and verify: Reboot if required, then unlock the volume with its original credentials. Use the BitLocker Recovery Key if the restore target has a different TPM. Verify access to the filesystem before returning the machine to production.
4. Summary
- Encrypted volumes are backed up as raw encrypted containers; restores return them in their original encrypted state.
- Expect Synthetic Full backups with minimal deduplication on every encrypted volume - size backup windows and storage accordingly.
- Keep volume credentials (LUKS passphrases, BitLocker recovery keys) available independently of the machine; they are required after every restore of an encrypted volume, and mandatory when the hardware changed.
StateWarden: Resilience Engineered.