Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The TrueCrypt website has some detailed information on how to backup (TrueCrypt non-system volumes) securely, summarised below:

  1. Create a new TrueCrypt volume
  2. Mount the main volume.
  3. Copy all files from the mounted main volume directly to the mounted backup volume.

My question is: Why is this necessary? Why not simply copy the encrypted TrueCrypt container file to your backup service/device? According to step 5 of the TrueCrypt tutorial, this container is a normal file that can be copied, moved, etc.

Surely copying this encrypted file to a possibly insecure backup medium is the simplest and most secure way to backup?

What advantages could there be to the method mentioned on the TrueCrypt website? It mentions at the start about files in the volume possibly becoming corrupted - is that relevant? In this case I'm not interested in hidden volumes or plausible deniability.

share|improve this question
up vote 18 down vote accepted

Backing up the TrueCrypt container means that you'll end with a timeline of your encrypted volume, and all of those versions share the same key. Having different versions of the container with the same key gives the adversary two advantages:

  • Information leakage: The adversary will know which sectors of the volume changed.
  • and, as a consequence, a compromise of the plausible deniability in case you have a hidden volume inside that volume.

In the real world, however, the case is quite different. If you don't have a hidden volume or you don't care about the adversary knowing about your hidden volume, then having some backups of the volume isn't really an issue. The cryptographic concerns (cryptanalysis) are, so far, only theoretical.

share|improve this answer
Thanks. It's good to know that TrueCrypt are so thorough with their advice and thinking ahead about potential attacks. I think in this case copying the encrypted file seems reasonable. – James Bradbury Nov 12 '13 at 11:43
I remember reading that having multiple versions of an encrypted container with the same key would give rise to possible cryptanalysis attacks. Was this any true ? – Wadih M. Dec 23 '15 at 2:04
@WadihM. It's not that easy to answer, really. TrueCrypt uses XTS mode for the block ciphers. You see, XTS is pretty much ECB in that each block is independently encrypted (but with some "tweaks"). Patterns of empty space are quite easy to spot with XTS, and with enough backup samples it's possible to detect more patterns. There isn't much public work done on this, so it's hard to say. My original answer still applies; yes, it's possible, but there's nothing tangible yet.. it's only "pre-theoretical". – Adi Dec 23 '15 at 2:38

Another way to address this issue would be to copy the container file and encrypt it eg. with openssl before backing it up. For subsequent backups you should use different keys/passwords for backup encryption.

It would be fairly easy to develop a scheme for rule-based key/password generation. Thus, you would rely on a recording passwords. This would make the revovery process much safer.

In my view, this would be easier/more comfortable then the approach the trueCrypt manual outlines.

share|improve this answer

Another considerable advantage is speed. If you have a large TrueCrypt container that is not full, your backup only needs to copy the bytes in use rather than the whole container. Standard tools like rsync or Windows robocopy will only copy files which have been changed, which is typically just a small fraction of your files. If you copy the container, you have to transfer every byte, and you generally have to dismount the drive so you have no access to your files at that time. On my eSATA drive, copying a 25GB container takes 15 minutes, which seems short enough until you start waiting for it.

If you have access separate computer on which to mount the backup container, rsync will transfer the changes securely via ssh, so you could roll your own remote backups.

share|improve this answer
How do you account for the time to create the new backup Truecrypt container, when following the "Create a new TC, mount both, copy files" advice? – Anti-weakpasswords Feb 25 '14 at 1:41
Personally I would re-use my containers, but even with a fresh volume every time, it all depends on the link speed and the % of the volume used. Creating a TC on a remote computer with a bus connection to its hard drive is much faster than transferring a complete volume over typical wifi or 100BaseT Ethernet. – WiringHarness Feb 26 '14 at 3:34

According to TrueCrypt security requirements, there are 2 main concerns regarding volume clones/copies:

  1. Original volume and backups (copies) would use the same key set.
  2. Ability to observe the changes between the backups might aid cryptanalysis if the attacker has access to the backups.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.