Restoring Data from Encrypted Backups

When you restore data from an encrypted backup, Veeam Agent for Microsoft Windows performs data decryption automatically in the background or requires you to specify a password.

• If encryption keys required to unlock the backup file are available in the Veeam Agent for Microsoft Windows database, you do not need to specify the password. Veeam Agent for Microsoft Windows uses keys from the database to unlock the backup file. Data decryption is performed in the background, and data restore from the encrypted backup does not differ from that from an unencrypted one.

Automatic data decryption can be performed in one of the following situations:

• You encrypt and decrypt the backup file on the same Veeam Agent computer using the same Veeam Agent for Microsoft Windows database.
• You have included encryption keys into the Veeam Recovery Media and perform bare-metal recovery after booting from this Veeam Recovery Media. To learn more, see Specify Recovery Media Options.

• If encryption keys are not available in the Veeam Agent for Microsoft Windows database, you need to provide a password to unlock the encrypted file. The password must be the same as the password that was used to encrypt the backup file. If the password has changed once or several times, you need to specify the latest password. In Veeam Agent for Microsoft Windows, you can use the latest password to restore data form all restore points in the backup chain, including restore points that were encrypted with an old password and restore points that were created before you have enabled the encryption option for the job.

To decrypt a backup file:

1. Launch the necessary data restore wizard:

• If you want to perform file-level or volume-level restore from an encrypted backup that was created on another Veeam Agent computer, right-click the Veeam Agent for Microsoft Windows icon in the system tray and select Restore > Individual files or Restore > Entire volumes. To learn more, see Restoring Files and Folders and Restoring Volumes.
• If you want to perform bare-metal recovery from an encrypted backup, boot from the Veeam Recovery Media and launch the Veeam Recovery Media wizard. To learn more, see Restoring from Veeam Recovery Media.

2. At the Backup Location step of the wizard, specify where the encrypted backup file that you plan to use for restore resides. If the backup file resides in a remote location, at subsequent steps of the wizards, select the backup location type and specify settings to connect to the backup location.
3. At the Backup step of the wizard, select the encrypted backup.

4. Veeam Agent for Microsoft Windows will display the Specify Password window. In the Hint field of the Specify Password window, Veeam Agent for Microsoft Windows displays a hint for the password that was used to encrypt the backup file. Use the hint to recall the password.
5. In the Password field, enter the password for the backup file.

If you changed the password one or several times while the backup chain was created, you need to specify the latest password. In Veeam Agent for Microsoft Windows, you can use the latest password to restore data form all restore points in the backup chain, including those restore points that were encrypted with an old password.

If you enter correct password, Veeam Agent for Microsoft Windows will decrypt the backup metadata. You will be able to pass to the Restore Point step of the wizard and continue the restore operation in a regular manner.