Using Ghost with Symantec Endpoint Encryption Full-Disk 6.x
Is it possible to use Symantec Ghost disk imaging to back up the data on a machine that has Symantec Endpoint Encryption (SEE) Full-Disk installed?
Note: Distribution of SEE to multiple systems using a base image is not supported by SEE. The method described in this document is useful for back-up and restore of unique systems only.
Because the full disk is encrypted Ghost is not able to read the file system by default, and therefore cannot take a standard image. Two methods around this are possible:
Booting from the Symantec Endpoint Encryption Recovery-CD to be able to access the un-encrypted drive contents.
Note: This method keeps the image much smaller, but it is not secure as the image is not encrypted. It is not therefore recommended except as an emergency imaging method.
Restoring an image through the Recovery-CD encryption layer is not possible because of a set of SEE system files which the software stores on the first encrypted partition. These files are fully hidden and protected from the OS by a boot time device driver, which also prevents access to the SEE "real" MBR on the first sector of the disk (redirecting access to the standard MBR stored elsewhere).