Here's an excerpt from official TSM documentation for TSM Server 7.1 as a 
limitation for deduplication:

Encrypted files
The Tivoli Storage Manager server and the backup-archive client cannot 
deduplicate encrypted files. If an encrypted file is encountered during data 
deduplication processing, the file is not deduplicated, and a message is logged.

Can we get more information on this statement?  How does TSM know that it has 
encountered an encrypted file?  Is it based solely on include.encrypt options 
from the client? Will it look at the object metadata to see if it's encrypted?  
Will it try to post-process an encrypted file?  In other words, if a file is 
encrypted say, using bitlocker or some third-party app, will TSM know not to 
process those objects for deduplication with the identify procedures?  What's 
the overhead in calculating this scenario out?  Has anyone tested this with TSM 
server 7.1?

Thanks!
Sergio