File-based backup of encrypted Linux systems?

I learned that tools such as clonezilla cannot omit free blocks when the disk is encrypted, which is a huge problem, since the backup drive always needs to have at least the same size as the source drive – even if the latter contains mostly free space! This is impractical and not how backups should work.

Let’s assume a standard Linux installation with a partition structure such as this (encrypted, LUKS on LVM). How do you create a bootable, file-based backup?

Idea: Use cp -a to copy all files from the source to the backup drive.

=> How to reproduce the partition structure from the terminal? Are there Linux built-in tools for this job? And will cp copy files that are currently open/in use (hot transfer)?

The idea, obviously, is to create a slim & sleek Bash script that could be run, ideally, directly from any running source system:

- Creating backup -

1.) Mount empty USB flash drive to running source system
2.) Run Bash script (hot transfer of all files and partition structure)
3.) Bootable, file-based backup is created


- Restoring backup -

1.) Mount backup USB flash drive to empty host machine
2.) Boot the backup system
3.) Run Bash script (partitioning of host drive, hot-transfer of all files)


...finished! Reboot, remove backup USB flash drive, enjoy restored system.

Note: If I’m correct, the resulting backup will not be encrypted. But this seems to be a necessary trade-off in order to use cp from within the unlocked system and thereby avoid creating these gigantic bit-by-bit images/clones. Plus, an encryption can always be added afterwards.