Encrypting an external hard drive with TrueCrypt

I'm curious about encrypting the drive versus encrypting a partition that takes up the full amount of drive space. From what I'm reading, it looks like to encrypt the drive (if it's a non-system drive), you have to delete all partitions. (Otherwise, you can only encrypt the partitions individually.)

Is there any advantage/disadvantage to deleting all partitions and encrypting the drive itself?

It seems that the only real difference is that if you encrypt a drive-sized partition, it means you'll lose any real deniability of encryption. One commenter stated: "Having an intact partition table followed by a gigantic partition filled with random data screams 'this is encrypted' and not securely erased."
(Of course a hidden volume could overcome this, but why let adversaries know it's encrypted at all if you can avoid it?)
I hadn't thought about that, but I suppose that's what would be the case if you encrypt a drive-size partition.

My only concern with deleting the partition and selecting the hard drive itself for encryption is the MBR vs GPT thing. My drive is over 2TB, so I'm worried about how TC will handle that....

Does anyone have experience with this? What happens if I delete all partitions on a >2TB drive and then encrypt it? Will TC give me any problems with recognizing all the drive space when I try to mount it?

 

Found this thread, which gives a lot of good info, and confirms my suspicion that I should just go with encrypting the whole device.

TrueCrypt: file, partition, drive

But I'd still be interested to get confirmation on my questions here concerning deniability and MBR/GPT.

 

I have encrypted >2TB drives with TC without any issues. As long as your OS can access a GPT partitioned drive >2TB, you'll be ok.

 

I was wondering about the exact same thing, as well as some other auxiliary questions which can be seen in it's full context here: https://www.wilderssecurity.com/thre...ing-a-non-system-drive-with-truecrypt.364375/

The summary of my main concerns is as follows:

Guess my biggest question and bewilderment is if all this applies equally to internal as well as the external drives. I can't imagine having to unplug my internal drives every time there might be a windows reinstall. (though I haven't done that before and it's been fine, I don't remember how my previous HDD was encrypted) And plausible deniability aside, the issue of header corruption is very ambiguous in one over the other in the partition vs device. As can be seen above in my quoted post.

P.s how can I check what option was used to encrypt my previous drive ?(partition or device lv encryption)

 

The safe, but undocumented, way to handle it is to repartition using gparted live to a linux partition type, then encrypt the partition, Windows neither offers to initialise the disk nor format the underlying partition, but truecrypt will happily encrypt it and format it to a windows compatible filesystem... and mounts it with no argument. Windows setup also won't touch non system drives or partitions which are prepared this way, unless you explicitly tell it to delete them, disk management sees them as an unsupported partition type.

The only downside is you have to park your data somewhere else while you do it, but then if you've nowhere to back that amount of data up to you'd be crazy to encrtpt it to begin with.

 

@Tekhne
I went ahead and deleted the partition and went with device encryption. Dantz's explanation made sense, and honestly I saw no reason to have a full drive-sized partition encrypted, while having a plaintext partition table. So when Dantz mentioned whole device encryption was "safer" anyway, it made the choice easy.

As for Windows offering to write a fresh partition table, I haven't had that issue so far. I think he's right, especially about the partition encryption...I can imagine having a physical drive with two partitions, one being encrypted, and Windows seeing it as an unformatted drive, and offering to do it...

BUT...

I actually can't say I recall that ever happening any time I plugged in actual unformatted drives. I know it would offer to format if I tried to navigate into the drive using the explorer (or actually it would say you have to format if you want to do anything with it)...but I don't ever remember being prompted without initializing something with the drive myself first.

That being said, it's been a while since I've used WindowsXP and plugged in an encrypted or unformatted drive. And I don't think I've ever tried to install Windows with an encrypted device plugged in, so I can't speak to that.

However, first rule of important data (particularly encrypted data) is of course always have a backup. When dealing with device/partition encryption, you'll want to have a backup of the headers too. With that alone, (and if you don't freak out and do something stupid), it sounds like you should easily be able to recover from most problems you'd see from encrypted drives. But of course, worst case scenario, you have to rely on the data backup. So I wouldn't worry too much about it.

Now my first guess as to the reason I haven't been plagued with any prompts like the ones Dantz describes is, in my folder options I have the option "Hide empty drives in the Computer folder" checked. I'm thinking that's all you have to do. (Note though that I'm using Win7 and I don't recall that option being available on WinXP.)

But you just open My Computer and click on the "Organize" menu at the top left... Folder and search options > View tab > "Hide empty drives in the Computer folder" and make sure that is checked.

To delete the partition on the drive I used MiniTool Partition Wizard. (I know everyone is all about Gparted, and it can certainly do things PWiz can't, but the latter is way simpler and gets the job done.)

 

Device encryption comes with added risk of having the disk "initialized" and modified by a windows install. I always use partition encryption.

 

@Morthawt
I think we covered that, didn't we?

 

likewise - but I encrypt "non windows" partitions, even safer

@blainefry
I'm only "all about gparted" because it's well known and free, my "use an unsupported partion type" can be done with many partitioning tools, or even WinHex or a partition table editor after the fact (if you understand what you're doing) - just change the partition type value and windows stops seeing the partition, never mind offering to format it.

 

@BeardyFace
All we're talking about is deleting a partition on an external hard drive. I think suggesting people start trying to mess with a hex editor is a little much don't you?

 

It seems like this has gotten a lot deeper than necessary. The title of the thread is "Encrypting an external hard drive with TrueCrypt". Who in the heck is going to leave an external drive connected while doing a Windows install?

And even crazier, who the heck installs Windows on an external drive?

I can understand a mention of the fact that Windows does that kind of thing just as a FYI, but why is this Windows install stuff even an issue for what these folks are asking?

 

@blainefry
I'm not recommending it, just pointing out it can be done, I *recommended* gparted live (or partitioning tool of your choice).

@Randcal
the problem isn't anyone trying to install on an external drive, it's that windows setup thinks it owns the entire machine and will "initialise" any empty drive it sees even if you specify a different target.. which is *somewhat annoying* if you lose the content of your external storage because you forgot to unplug it while you installed to the *internal* drive.. easily done if you just backed up data to it befrore the install

You've read the cautions, and will avoid the problem, the point of what I describe doing, is that the storage drive (once set up) could be for instance, handed to office workers with varying degrees of skill.. without the worry that *they* get a prompt to format while poking about and follow it.. because the prompt simply won't appear (or that their kids get a prompt if *they* plug it in). If you can for a small effort make something um.. idiot-resistant (idiot-proof is impossible) then why not do so?

 

I see, then I suspect that is one possible route to go then..perhaps, but what about the rest of my questions ? e.g. if it applies equally to internal drives as well as external. It seems weird and unintuitive to have to disconnect an internal hdd everytime you reinstall windows as mentioned. And as well as how I can see what encryption method has been used by me earlier.

And is gaprted live necessary for all this ? I read somewhere online about just changing a number in the zero sector on the HDD, and that was apparently all it took to change it from a windows partition to a linux one. (think it was maybe with a hex editor)

@Randcal This has nothing to do with installing windows to an external device.
Secondly it is an issue for the reasons mentioned above, like:

And there's plenty of folks who would leave their externals connected while doing a win reinstall. No reason why they wouldn't, I would have been one of them unless I had happened to stumble upon this information here.

 

@Tekhne
I answered the questions I have personal experience with to confirm, since I'm using TC on a laptop, testing with internal drives would be awkward, I could play with vmware/virtualbox/MS-VirtualPC to perform a test, but then so could you. Having found a method which protects TC encrypted partitions from damage, I saw no reason to investigate further.

Is gParted Live necessarry? I answed that later in the thread too, it's absolutely possible as you say to simply edit the partition table, but the potential for possibly catastrophic errors is far higher, so I won't give details of partition types and what bytes need editing to do it, either you know how, or you should be using a graphical tool to do it.

Any graphical partition manager will do if you're religiously opposed to gParted, there are a number that run under windows that will create non windows partitions, personally I'd rather burn an iso which I can later delete, than install a program which may or may not subsequently uninstall cleanly.

Dedicated partition table editors also exist, I have one from an old partition magic install (back when it was PowerQuest), these types of tool are less error prone than hex editing, as you just update the appropriate box with a different hex value, but why send people hunting a complex and still dangerous tool, when gParted and it's kin are widely available and safer for Joe Average User to run?

 

@blainefry Eh excuse me but the forum deleted what I had written to you when I added you as a mention...sigh. Also I somehow did not see multiple of the responses above until after my last reply had already been posted. But I was basically saying though: It might be safer with device encryption for other reasons, but according to what dantz said not any safer in terms of windows destroying the header at least. I know, I've never gotten that initialization prompt either unless I double clicked my drive. Also I'm strongly wondering if this whole header danger equally applies to internal drives as well and not just external. Like mentioned before it would be very tedious having to unplug your internal drive every time you do a windows reinstall. Don't you have an internal drive thats encrypted as well ?

I really don't want to be afraid and paranoid for no reason running around unplugging all my internals for no reason every time I might do a windows reinstall....

@BeardyFace Thanks for your answers, and sry I missed a lot of replies above as if they weren't there when I was reading this and responding, I don't know how it happened.
Anyways, about partitioning to a linux partition, I'm wondering then, is that only possible when choosing to encrypt a partition. For I am quite lenient on encrypting the whole device, if I choose that, can I can still employ that linux trick ?

Oh, and for everybodies information, I was gonna ask how to backup the TC header, but after snooking around online some, found out that TC actually has a built in header backup function :} You find it under volume tools, just unmount the volume first.

 

@Tekhne
It's a while since I've played with encrypting entire drives (other than the main system drive) if I'm remembering correctly, no the trick doesn't work if you encrypt the entire drive, and it will hector you to initialisze the drive if you open disk management, and other triggers, it's not something I've tended to do, I play with multiboot setups and OS installs making me an atypical user, having a drive which appears unpartitioned in my use pattern, you can bet it's the target for the OS I'm about to load, not a TrueCrypted drive...

dantz is a true expert on the subject, and I truly respect his views, you run some risks either way, if the old TrueCrypt forum was still viewable you could find there endless copies of each of the:
"Windows initialized my encrtpted drive"
"I accidentally clicked format my encrypted partition (internal or usb drive)"
"I used <XYZ> imaging software and it got frisky with my partition boundaries"
threads, I wouldn't like to say which of the first two was more common. You pays your money and takes your choice, but that linux partition trick would have eliminated all the first and a huge proportion of the second type, especially with drives mounted on multiple machines, and a proportion of the third.
The third type being the most likely to be completely unrecoverable, but less common than the other two.

He's undoubtedly and indisputably right that recovery after damage is somewhat easier if you go for the whole device, the relative likelihood of damage becomes moot if you employ that linux partition type trick, it's your penny, only you can toss it.

But one more item to toss in to your decision process a good backup makes you proof against all 3!

 

One more thought, in case you're leaning towards the whole drive to plausibly claim it's freshly wiped, I've never personally understood why

Code:

dd if=/dev/urandom of=/dev/sdb

should be more plausible than

Code:

dd if=/dev/urandom of=/dev/sdb1

the latter saves you repartitioning before you reformat.
Both fit with having a Linux partition defined.

 

@BeardyFace Thanks again. Yes quite annoying they did what they did with the TC forums, I wanted to visit there before, but they would not let me. I don't recall the problems or requirements they had anymore, whatever it was it effectively stopped me from doing anything there.

Hmm your 3rd point is somewhat startling... I had no idea imaging software could cause that too. And being devoid of such insight I don't understand how the linux trick prevents that particular issue either, it all seems so uncorrelated to me. (I thought imaging software wasn't supposed to change anything, just copy, with emphasize on exact precision even.) But I remember scratching my head when dantz mentioned that people often mess with their partition boundaries, yet I have no idea what that implies, i.e. what one has to do.

As it is I have Acronis True Image, for backup. And I've made backup using the regular disk method, and file copy method so far from an encrypted disk. Should I start worrying about being able to make backup as well from my TC drive ?

I don't consider myself likely to press format by mistake though. As long as windows doesn't just do it without asking(which I consider one of the biggest issues I was hoping I'd get to the bottom of). I honestly don't see too much problem with the first two issues. But the 3rd point you just introduced now made me go yikes.

Your second post hehe, is I'm afraid, ironically, like "code" to me, and over my head ^^

P.s. I would like to seize the chance if you happen to know if it's unadvisable to do any type of work on my pc while my separate non-system data drive is being backed up ?

 

Imaging software isn't supposed to change anything, however, when you come to restore, many allow resizing partitons, some make "automatic adjustments" to fit the disks.. these are very bad ideas when encryption is involved, depending on the software, they might leave linux partitions unaltered (quite common with windows based programs) while adjusting the size of windows ones, or might "adjust" everything, using logic like "anything unformatted must be free space and not matter right?", except TC volumes appear unformatted and it sure as hell DOES matter......
And if your disk was originally set up by say XP on CHS boundaries, and the imaging software restores to MiB boundaries to suport 4k sector disks.. Oh boy! (and quite often bye-bye headers)

Frankly disabling anything "intelligent" in imaging solutions is your safest bet and fall back to "Stupid / sector by sector / forensic" images. Or file based backups to other encrypted storage.

I've never mistakenly accepted Windows' offers to format either, and you can unassign drive letters in disk management to avoid it offering too for disks that copy of Windows has seen before.

Windows generally doesn't format or initialise disks withouut asking, Windows *setup* is a horse of a different colour.

Don't worry about the second post, they're just the linux commands you might typically use to wipe a second drive or partition respectively with random data.

For your p.s. Acronis and most other backup/imaging softwares tend to be pretty good at handling other things happening on the PC at the same time, just don't bank on backing up mounted TC file based containers by backing the hosting file up, busy sql databases, or virtual machine disks *reliably* when they're in use, such tends to be asking a bit much of their "in use" file handling capabilities.
As a general principle- always set the software to auto-verify backups, this will tend to catch any glitches caused by concurrent computer use.

 

@BeardyFace
I'm beginning to wonder about if acronisTI(TrueImage) is the best solution then, even it's file backup creates their proprietary tib. image format. And very coincidently I was just recently reading about how AcronisTI uses some kind of "smart" sector backup, and only does 'true' sector-by-sector backup in certain circumstances, though that might have been only in regards to the older versions, I would not dare to say.

Besides what you already mentioned, there's also the potential issue when one just needs to get one or two files from a 500gb bk. But can't without restoring all of it afaik. I can live with that though, since the backup is not intended for convenience but in case of emergency. I have never tried to restore my data before so I have no idea if it would be troublesome or not with what you mentioned about adustments and the TC headers.
I tried some free apps in the past, until I read that they had errors, and could "forget/ignore" some of the data to be backed up ><. So I stopped using them. Thats when I decided it was time to stop screwing around and go buy something proper and reliable lol, or at least so I thought.

Regarding windows setup....I made a backup of the headers today, and in doing so, I was able to find out what method had been used to encrypt my drive previously. And that was partition level encryption. (Becasue I tried first by selecting device and then the password did not work, then I selected the partition in order to bk the header and it worked) So with that established, that drive has been unaffected by windows setup until now, and I've done a few reinstalls of windows. So unless I've just been very lucky I think we can establish then that in a setup like mine, with a partition level encryption, windows setup leaves it untouched and unharmed.

P.s. I did in fact notice a verify image after backup in my so far limited use of the program, I was surprised why it was not selected by default. I selected it immediately, it was practically the only thing I was intuitively sure of to modify among the settings.
Oh and the more I use windows, the more I get the impression that its pretty stupid. And I've been using nothing but that since around 1999 starting with win98. If you ask me, the whole tech world needs a coherent unified overhaul for the better.

p.p.s. in order to try and be a little forseeing, if I now or ever try changing the partition to linux, is there multiple choices that will be obscure to me, or is it just called linux, so that even I can be able to pick the right choice ?

 

@Tekhne
Acronis is a suitable program if used with care and thought, I used to use it myself until they dropped support for Echo Workstation, however, you pretty much have to turn the intelligent sector copy off when true-crypt is involved, it can be disabled in the advanced settings. Backing up your system drive with windows running always produced a backup which when restored, was both unencrypted, and required a startup repair before you could even boot it to re-encrypt. I used to use the rescue/restore CD to do the backup, with it set to sector by sector from outside windows, the image would restore to a bootable encrypted system that way. I switched to Macrium Reflect at that point owing to reasons of price, and that the documentation for v4.x (current at the time) had a whole section about working with TrueCrypt, imaging a live system still gave you an unencrypted restore, but without having to do the startup repair, the section is missing in the v5.x docs, but still applicable.

With either program images can be mounted, much like TC volumes can, and files to restore simply copied and pasted from the mounted "drive", at least when they were made on a live system, and both provide means to restore individual files from file/folder backups.

Even imaging solutions tend to purposely ignore things, if they do anything "intelligent", typically they'll ignore the pagefile, hibernation files, and sometimes temporary files and cache contents, if you turn their intelligence off you'll get everything back, including deleted files in apparently empty space. The cost is lower performance and bigger backups. In file and folder mode, you get back what you selected to back up.

I've not had windows setup mess up *partiton based* TC encryption either, I can't comment on device based encryption, apart from encrypting entire systems with only one drive (laptops) I haven't used it to speak of.

Windows is indeed pretty stupid, having used 3.1, 3.11, NT3.51, 95(a b and c), 98, 98se, (skipped ME), 2000, XP, (briefly)Vista, 7, & very breifly 8, default intuitiveness peaked at 2000 and they've been making it harder again ever since.. for a desktop system 8 regresses useability back to par with 3.11, I'll switch to linux before I'll downgrade from 7 to 8.

Regarding if you create a linux type partition to later truecrypt encrypt, you could pick any of a whole SLEW of options, the one gParted offers by default does nicely, the reason (one of the reasons) that imaging progs tend to leave linux partitions unaltered, is that to mess with finessing the sizes you'd have to build into the program support for reading, checking, and resizing ext2,3,4 reizer fs, and others, so it could do so without data or file system damage.
Windows developers tend to take one look at the needed work throw up their hands and say "Fu.. er..get that - if it's linux in the partition table we'll do sector by sector and not alter it", they probably skip the oral edit if there's no manager near.
That just so happens to be a safe approach for truecrypt volumes too.

 

@BeardyFace Ah, I've already created a backup without altering any settings except for adding validation, since I was in a rush and getting increasingly worried for not having one...At least I have that now. (I've been worried the old drive could die at any time.) Turning of that intelligent sector copy applies equally when doing file backup also then ? But since you mentioned it's possible to access individual files. Then I foresee the possibility of just mounting the image and copying it from the mounted image perhaps instead of using the "default" acronis restore function as an ad hoc solution if it's an issue? Then at least I'll have a way, even if it is not the most convenient.

Though since I need to transfer all the data from my old drive to the new anyway, I thought I would transfer the data from the backup to the new drive(unless you think thats a bad idea, I wouldn't know :/). And since the new drive is empty anyway, I thought it might be interesting to try it out and see of it works. Cause then if it doesn't I won't loose any data. Though it's a bit vague for me, you basically told me that imaging software like this, with these intelligent features can possibly not work, but not that it's certain that it won't as far as I have come to understand you.

Yes, seeing as you only have the systems drive encrypted or externals anyway.

Since I'm not very techy, at least not on the level around here and with these kind of details and things, I cringe a bit from having to get into more stuff, like changing partitions, I'd rather just click No occasionally if it prompts me, I can live with that. It's simple enough for me to manage. It's just the very few times I forget myself and double click the unmounted drive it happens.
As long as setup doesn't do anything outside of my control, which is why I created a separate thread just for that issue today, hopefully that will put it in the spotlight.

Thanks again for helping out.

 

@Tekhne

File based backup is just that, file based, either you can see the file and select it to backup, in which case it gets backed up (assuming you have read permission for it), or you can't and it doesn't.. It's not much use for transferring a system to a new drive, great for static data though, since there's no need to drag along system volume information, recycle, filesystem journals etc.etc., which just waste space. With either backup type Acronis will allow you to explore the backup and restore individual files and folders by copy and paste.

I have used partition based encryption on other drives besides the main one, since that second internal drive also had unencrypted data.. which I wished to remain that way ( to avoid the decryption overhead watching movies - it was an old PIII box, now running Linux) so I am familliar with partition based encryption, device based would have been unsuitable. I'm not certain how you got the impression I hadn't, but non-system device-based is the only type I haven't used...

Since you now sound like this isn't just a simple "encrypt new drive I just bought" situation (which is what the OP asked about), I'll try to cover all bases getting your data onto it, how you encrypt has been done to death, if you still can't decide toss a penny.

To transfer to a new different size drive in the case of an encrypted system (using Acronis/Macrium/Other) without other hardware changes:

1. Make image (intelligent sector copy turned OFF) while booted from the Acronis/Macrium/Other boot CD
2. Change drive
   
3. Restore image to new drive
   
4. Decrypt system
   
5. Resize partition(s) to suit using Disk Management / gParted / Other
   
6. Re-encrypt system
7. Make new TC rescue CD and TEST IT
8. Make image (intelligent sector copy turned OFF) while booted from the Acronis/Macrium/Other boot CD - This is your backup for the system.
   
9. Get rid of old backups and old TC rescue CDs to avoid confusion.
10. Good to go.

In the case of an identical size drive (or restore after a problem)

1. Make image (intelligent sector copy turned OFF) while booted from the Acronis/Macrium/Other boot CD
2. Change drive
3. Restore image to new drive
4. Good to go.

In the case of replacing an external with a substitute

1. Encrypt new external storage (by whichever method you finally, eventually, at last decide on, sometime preferably before the old one fails, and preferably while the new one still has some of the guarantee left, you usually only get a year on externals, before SATA becomes obsolete is probably a good idea too)
2. Mount both new and old storage
3. Copy files across.
4. Good to go.

Use file / folder based backup for this drive while mounted - either to other encrypted storage, or using the Acronis/Macrium/Other built in encryption (depending on your threat model / trust level)
If you have to restore your backup, mount the volume (or replacement volume) and restore to it.
Or use this as a practice run instead of copy/paste above.

If replacing a drive inside a single external case

1. Backup as above
   
2. replace drive
3. encrypt
4. mount
   
5. restore backupped files.
6. Good to go

Drive imaging only complicates things (especially restores) for plain old data drives.

Have I covered it? Or are you going to switch round what you're trying to achieve again?

As long as you have a good current backup, it doesn't really make a scrap of odds which you pick file-container/partition/device, because if you (F/M)uck up, you just restore and no harm done. If you don't keep a current backup Murphy will find the one mode of failure you can't recover from, whichever you chose, it's THAT simple. The decision is yours, to base on which failure mode / error you think it's most important to avoid, but still backup regularly, because give it long enough and you WILL lose data unless you do.

 

@BeardyFace Hmm, well I just tested mounting the image with acronis, and it could not mount it, said "the archived format is not supported by this operation" Seems then from that, that either backup can't do that.

Well I asked earlier about this when I asked about my other questions, like if it would apply to only external drives or also internal, and so having to unplug them. But then you replied with that you didn't have any experience with it: "I answered the questions I have personal experience with to confirm, since I'm using TC on a laptop, testing with internal drives would be awkward," Showing that you didn't have experience with it. Which is what I drew my thoughts on. But no matter.

When you say "a single external case", you mean my desktop, or something like a NAS ?

I am a bit unsure why you mention this "switching around again what I'm trying to achieve" since I haven't been changing my mind around, earlier, or again now to my objectives. Or if your hinting to something slightly pejorative.

But here are some updates I think are good, along with a new question arising. First I found a nice app called Teracopy which seem to be a neat program for me in this with transferring data from one drive to the other if I need to do so before relying exclusively on the acronis TI software.(perhaps that is better suited for plain transfer, and using TI just for backup, and perhaps while resolving if actually a sufficient solution at all if it can't access the individual files of the image. You also mentioned Drive imaging only complicates things, so far my impression would agree on that, perhaps TI is less of a suited app for my simple data drive backups than some other solution ? The only thing I think of as a neat thing is the ability to be able to do things like differential backups instead of full ones. As would be the case more or less if I just used a copy paste program) The question in relation to the encryption, method that adds to the convolution of it all is almost the same as something I was wondering about in the beginning, that is that small extra partition that seems to be made by default in addition to the main one. Could not that be a security risk ? like if the possibility of any information from the main partition ending up being stored there. Then it would circumvent the whole encryption if it's some fancy new buffer stuff thats on these SSD's.

An other strange discrepancy I noticed is that after I tested encrypting it on a partition level, (it only took about 30 mins being an SSD) it is shown as being an NTFS partitioned drive, which is odd, cause the other drive/s both the old internal and external backup does not show that, even though they are encrypted the same way as well i.e. partition level. And also when double clicking them to create the windows promp of asking to format and so on, they even produce a similar but different message ><

 

What I have (old) experience with, some years ago, and what I have the ability currently to test are different things, I *used to* have TC on my desktop, currently it's only on the laptop, so tests become awkward, short of setting up a vm and a load of virtual test drives, which you not only *could* do yourself, but really *ought to* to test, that way you'll have direct experience, instead of not accepting what people say anyway.

My experience with Acronis is also old, with a version no longer supported, and how tthe TI/TC combination behaves seemed to change with each version when I did use Acronis. It varied seemingly randomly between being a viable complete solution, and utterly useless, as the version numbers changed.

I have, in the past, managed to mount a TI image, then mount a TC partition within it, I have *no idea* if that's possible with the current version or not, and since the version I had is incompatible with Win7 the only way to find out is trial and error, you're the one with the software, try it and see.

I've also pulled the same stunt with Macrium Reflect (version 4.x) I've no idea from experience if it still works under the current 5.x versions or not, having no tc partition to image and try with.

Final word:

There is absolutely no substitute for finding out for yourself.

If you still can't decide, after all this.. find yourself a penny, decide which way is heads, and throw it in the air!