Restoring to the computing device that was originally backed up

System restoration from a system image works best when systems are restored to the same computing device from which the original backup was made. If your system was infected with malware, for example, and you restore to the same device from an image created before the malware infection took place, the system should work well. (Of course, you would lose any work and other updates done since that time, so hopefully you backed them up using one of the methods in Chapter 14.)

Full system restores are often irreversible. And if a restore fails, as can happen if a backup is corrupted or for any one or more of a number of reasons including some discussed in the next section, you could have a system that is unusable in its present form. Be absolutely sure that you want to run a full system restore before you actually run one.

Restoring from a full system backup is likely the fastest way to restore an entire system, but the process can take dramatically longer than restoring just a few files that were corrupted. It is also far more likely to lead to accidentally erasing settings or data created since the last backup. As such, use a full system restore only when one is truly needed.

If you accidentally delete a bunch of files or even folders, do not perform a full system restore. Just restore those files from a backup using one of the techniques described later in this chapter.

Restoring to a different device than the one that was originally backed up

System restoration from an image often won’t work on a system with totally different hardware components than the system that was originally imaged. In general, the more different a system is from the system that was imaged, the more problems that you may encounter.

Some of those problems may autocorrect. If you restore a system with drivers for one video card to a system with another video card, for example, the restored system should realize that the wrong drivers are installed and simply not use them. Instead, it defaults to the operating system’s built-in drivers and allows you to install the drivers for the correct card (or, in some cases, automatically download them or prompt you to do so).

Some problems may not autocorrect. For example, if the computer that was backed up used a standard USB-connected keyboard and mouse and the device to which you are restoring uses some proprietary keyboard that connects differently, it may not work at all after the restore; you may need to attach a USB keyboard to the system to download and install the drivers for your proprietary keyboard. Such situations are becoming increasingly rare due to both standardization and improvements in modern operating systems, but they do exist.

Some problems may not be correctable. If you try to restore the system image of a Mac to a computer designed to run Windows, for example, it won’t work.

Some backup software packages allow you to configure a restore to either install separate drivers or search for drivers that match the hardware to which the restoration is being done to replace those found in the backup that are unsuitable. If you have such a feature and have difficulty restoring without it, you may want to try it.

A full system backup may or may not include a backup of all content on all drives attached to a system, not just those mounted inside of it. (Theoretically, all such drives should be included in a system image, but the term system image is often used to mean an image of the internal hard drives and SSDs.)

If a device for which you have an image fails, you should be able to use the system image to re-create the entire system as it was at the time that the backup was made. When you use the rebuilt system, it should function exactly as the previous system did at the time of the backup.

Original system images

If you want to recover to the original factory image of a system prior to restoring your data and programs, see Chapter 15, which is dedicated to performing such restorations.

After performing such a factory reset, one or more (or possibly all) patches and other security updates that you have installed on the device may be gone. Your device is likely vulnerable to various compromises. Immediately after restoring, you should, therefore, run the operating system update process (repetitively until it finds no needed updates) as well as the update process for any security software (also repetitively until it finds no needed updates).

Only after those steps are completed should you install other software, restore your data, or perform any other online activities.

Later system images

Before you restore from any system image, you must ascertain that whatever problem occurred that necessitated the restoration will not remain, or be restored, during the restoration. If your computer was infected with ransomware, for example, and you remove the malware with security software, but need to restore the criminally encrypted files from a backup, you do not want to end up restoring the ransomware along with the data.

If you know for certain that an image was made prior to the arrival of the problem, go ahead and use it. If in doubt, if possible, restore to an extra device and scan it with security software prior to performing the actual restoration. If you do not have an extra device to which you can restore and are unsure as to whether the backup is infected, you may want to hire a professional to take a look.

Installing security software

After you restore from a system image (whether factory settings or a later image), the first thing that you should do is check whether security software is installed. If it is not, install it. Either way, make sure to run the auto-updates until the software no longer needs updates.

Install security software before attempting to do anything online or read email. If you do not have security software in place before you perform such tasks, performing them could lead to a security breach of your device.

If you have the security software on CD, DVD, or USB drive, install it from there. If you created a USB drive or other disk with the security software on it, you can install it from there. If not, copy the security software to the hard drive from wherever you have it and run it.

Original installation media

For programs that you acquire and install after you purchased your device, you can reinstall them after you restore the original system image or even a later image that was created before the software was installed.

If you reinstall software from a CD, DVD, or USB drive any updates to the software that were released after the CD, DVD, or USB drive image was created will not be installed. Be sure to either configure your program to auto-update or manually download and install such updates. In some cases, software installation routines may also ask you whether you want them to automatically perform a check for updates immediately upon the completion of the installation. In general, answering affirmatively is a wise idea.

Downloaded software

The way that you reinstall programs that you previously purchased and installed at some point after you purchased your device depends on where the software is located:

• If you have a copy of the software on a thumb drive, you can reinstall from the drive by connecting it into your device, copying the files to your hard drive, and running the install.

  If there is any possibility that the thumb drive is infected with malware — for example, you’re restoring due to a malware infection and may have inserted the thumb drive into your infected computer at some point in the past — make sure to scan it with security software before you run or copy anything from it. Do so from a device with security software running that will prevent infections from spreading upon connection from the drive to the machine being used for scanning.

• If you copied the software to a DVD, USB drive, or CD, you can install from that disc. Make sure to install all necessary updates.
• If the purchased software can be redownloaded from a virtual locker, do so. In some cases, software that is redownloaded will have been automatically upgraded to the latest release. In other cases, it will be the same version as you originally purchased, so make sure to install updates.
• If the software is downloadable from its original source (public domain software, trialware that you activate with a code, and so on), feel free to redownload it. In some cases — for example, if newer versions require paying an upgrade fee — you may need to download the version that you had previously. In any case, make sure to install all updates for the version that you do install.

Restoring from full backups of data

In many cases, it makes sense to restore all the data on a device:

• After a restore from a factory image: After restoring from a factory image and reinstalling all necessary software, your device will still have none (or almost none) of your data on it, so you need to restore all your data.
• After certain malware attacks: Some malware modifies and/or corrupts files. To ensure that all your files are as they should be, after an infection, restore all your data from a backup. Of course, this assumes that you have a recent enough backup from which to do so without losing any work.
• After a hard drive failure: If a hard drive fails, in full or in part, you will want to move your files to another drive. If you have a separate drive for data than for the operating system and programs — as many people do — performing a full restore of data is the easiest way to restore.
• When transitioning to a new, similar device: Restoring from a backup is an easy way to ensure that you put all your data files onto the new device. Because some programs store settings in user data folders, copying the files directly or performing a selective restoration from a backup is usually a better way to go. But as people sometimes inadvertently leave out files when using such a technique, full restorations are sometimes used.
• After accidental deletions: People occasionally accidentally delete large portions of their data files. One easy way to restore everything and not worry about whether everything is “back to the way that it should be” is to do a full restore of all data.

Unlike restoring from a full system backup, restoring from a full data backup won’t restore applications. If a system has to be rebuilt entirely, recovering from full backups of data likely requires prior restorations to factory settings (or a later image of the computer) and reinstallation of all software.

The multi-step process of restoring from a factory image and then reinstalling applications and restoring data may seem more tedious than simply restoring from a more recent system image, but it also usually proves to be far more portable. Recovery can usually be done on devices that vary quite a bit from the original device, using images of those devices (or onto a new device), followed by the reinstallation of programs and the restoration of data.

Incremental backups of data

In many cases of home users, incremental backup refers to incremental backups of data. To recover data that was backed up using an incremental backup scheme requires multiple steps:

1. A restoration must be done from the last full data backup.
2. After that restoration is complete, restoration must be performed from each incremental backup performed since that last full backup.

Failing to include any of the incremental backups necessary in Step 2 may lead to corrupt data, missing data, data being present that should not be, or inconsistent data.

Most modern backup software will warn (or prevent) you if you try to skip any incremental backups during an incremental restoration. Such software, however, sometimes does not, however, tell you if you’re missing the final backup or backups in a series.

Incremental backups of systems

Incremental system backups are essentially updates to system images (or partial system images in the case of partial backups) that bring the image up to date as of the data that the backup was made. The incremental system backup contains copies of only the portion of the system that changed since the preceding backup (full or incremental) was successfully run.

To restore from an incremental backup of a system:

1. A restoration must be done from the last full system backup.
2. After that restoration is complete, restoration must be performed from each incremental backup performed since that system image was created.

Failing to include any of the incremental backups necessary in Step 2 may lead to corrupt of missing programs, data, operating system components, and incompatibility issues between software. Most modern backup software will warn (or prevent) you if you try to skip various incremental backups during a restore from an incremental backup. They often do not, however, tell you if you’re missing the final backup or backups in a series.

Differential backups

Differential backups contain all the files that changed since the last full backup was successfully run. (They are similar to the first in a series incremental backups run after a full backup.)

While creating a series of differential backups usually takes more time than creating a series of incremental backups, restoring from differential backups is usually much simpler and faster.

To recover from a differential backup:

1. Perform a restoration from the last full system backup.
2. After that restoration is complete, perform a restoration from the most recent differential backup.

Be sure to restore from the last differential backup and not from any other differential backup.

Many backup systems won’t warn you if you attempt to restore from a differential backup other than the latest one. Be sure to double-check before restoring that you’re using the latest one!

Table 16-1 shows the comparative restoration processes from full, incremental, and differential backups.

Continuous backups

Some continuous backups are ideal for performing system restore. Similar to a system image, they allow you to restore a system to the way that it looked at a certain point in time. Others are terrible for performing restores because they allow restoration to only the most recent version of the system, which often suffers from the need to be rebuilt in the first place.

In fact, the normal use of continuous backups is to address equipment failures, such as a hard drive suddenly going caput — not the rebuilding of systems after a security incident. Furthermore, because continuous backups constantly propagate material from the device being backed up to the backup, any malware that was present on the primary system may be present on the backup.

Partial backups

Partial backups are backups of a portion of data. Likewise, partial backups are not intended to be full backups in case of a malware attack or the like. They are useful, however, in other situations, and you should be aware of how to restore from them.

If you have a particular set of files that are extremely sensitive and need to be backed up and stored separately from the rest of your system, you may use a partial backup for that data. If something happens and you need to rebuild a system or restore the sensitive data, you will need that separate partial backup from which to do the restore.

Digital private keys that provide access to cryptocurrency, email encryption/decryption capabilities, and so on, for example, are often stored on such backups along with images of extremely sensitive documents.

Often, partial backups of sensitive data are performed to USB drives (or, in cases of less up-to-date environments, writeable DVDs, CDs, or even floppy disks!) that are then locked in safes or safe deposit boxes. Restoring from the backup would, in such cases, demand that the restorer obtain the physical USB drive (or other form of media), which could mean a delay in restoration. If the need to restore arises at 6 p.m. Friday, for example, and the drive is in a safe deposit box that is not available until 9 a.m. Monday, the desired material may remain inaccessible to the user for almost three days.

Make sure that you store your partial backups in a manner that will allow you to access the backed-up data when you need it.

Another common scenario for specialized partial backups is when a network-based backup is used — especially within a small business — and users need to ensure that they have a backup of certain material in case of technical problems while traveling. Such backups should never be made without proper authorization. If permission has been obtained and a backup has been created, a user on the road who suffers a technical problem that requires restoration of data can do the restore by copying the files from the USB drive or other form of media (after, presumably, decrypting the files using a strong password or some form of multifactor authentication).

Folder backups

Folder backups are similar to partial backups because the set of items being backed up is a particular folder. If you performed a folder backup using a backup tool, you can restore it using the techniques described in the preceding section.

The restore process is different if, however, you created the relevant backup by simply copying a folder or set of folders to an external drive (hard drive, SSDs, USB drive, or network drive). Theoretically, you simply copy the backup copy of the folder or folders to the location of the original folder. However, doing so will potentially overwrite the contents of the primary folder, so any changes made since the backup will be lost.

Drive backups

A drive backup is similar to a folder backup, but an entire drive is backed up instead of a folder. If you backed up a drive with backup software, you can restore it via that software. If you backed up a drive by copying the contents of the drive somewhere else, you will need to manually copy them back. Such a restore may not work perfectly, however. Hidden and system files may not be restored, so a bootable drive backed up and restored in such a fashion may not remain bootable.

Virtual-drive backups

If you backed up an encrypted virtual drive, such as a BitLocker drive that you mount on your computer, you can restore the entire drive in one shot or restore individual files and folders from the drive.

Multiple files stored within one file

Sometimes multiple files can be stored within a single file. This concept was addressed with the concept of virtual drives earlier in this chapter and in Chapter 13. However, storing multiple files within one file does not necessitate the creation of virtual drives.

You may have seen files with the extension .ZIP, for example. ZIP files, as such files are called, are effectively containers that hold one or more compressed files. Storing multiple files in such a container allows for far easier transfer of files (a single ZIP file attached to an email is far easier to manage than 50 small individual files). It also reduces the amount (sometimes significantly) of disk space and Internet bandwidth necessary to store and move the files.

There are other forms of ZIP files that have the file extension .ZIPx. These files have been compressed with even more advanced compression mechanisms than standard .ZIP files, but are not able to be opened by many computers unless special software is installed in addition to the operating system. In addition to ZIP files, there are many other forms of compressed containers of files, and the files containing them have many different extensions, but ZIP is — by far — the type most people will encounter the most often.

If you need to restore files from a ZIP or similar archive, you can either extract all the files from the archive to your primary source, or you can open the archive and copy the individual files to your primary location as you would with any files found in any other folder.

Archive files come in many different formats. Some appear automatically as folders within Windows and Mac file systems and their contents as files and folders within folders. Others require special software to be viewed and extracted from.

Old live data

Sometimes old data is moved off of primary systems and stored elsewhere. Storing old data can improve performance. For example, if a search of all email items means searching through 25 years’ worth of messages, the search will take far longer than a search through just the last 3 years. If nearly all relevant results will always be within the last few years, the older emails can be moved to a separate archive where you can access and search them separately if need be.

If you use archiving, factor that in when restoring data. You want to ensure that archives are restored to archives and that you don’t accidentally restore archives to the primary data stores.

Also, keep in mind that even if you believe that data is not needed on a regular basis, you may be subject to regulations regarding its storage and safety. There are two primary aspects to this point. First, never delete an archive just because you have restored from it. Some data may be required to be retained for certain periods of time or even, in some cases, indefinitely, and the archive may have been created for that reason. Second, certain data may be subject to security and privacy regulations for as long as it is stored and wherever it is stored — sometimes restoring old data can bring with it security and privacy requirements.

Old versions of files, folders, or backups

The term archives is also sometimes used to refer to old versions of files, folders, and backups even if those files are stored on the primary data store. Someone who has ten versions of a contract, for example, that were executed at different points in time, may keep all the Word versions of these documents in an Archive folder. Archiving of this sort can be done for any one or more of many reasons. One common rationale is to avoid accidentally using an old version of a document when the current version should be used.

If you’re archiving, factor that in when restoring data. Restore all the archives to their proper locations. You may see multiple copies of the same file being restored; don’t assume that that is an error.

Restoring from a Windows backup

To restore from a Windows backup to the original locations from which the data was backed up, follow these steps:

1. Choose Start ⇒ Settings ⇒ Update & Security ⇒ Backup.
2. Click Restore files from a current backup.
3. In the File System viewer, browse through different versions of your folders and files or type and search for the name of the file you’re looking for.
4. Select what you want to restore.
5. Click Restore.

Restoring to a system restore point

Microsoft Windows allows you to restore your system to the way it looked at a specific time at which the system was imaged by the operating system:

1. Click the Start button and select Settings.
2. Choose Control Panel ⇒ System and Maintenance ⇒ Backup and Restore.
3. Click Restore My Files to restore your files or Restore All Users’ Files to restore all users files (assuming that you have permissions to do so).

Restoring from a smartphone/tablet backup

Many portable devices come equipped with the ability to automatically sync your data to the cloud, which allows you to restore the data to a new device if your device is lost or stolen. Even devices that do not have such a feature built in almost always can run software that effectively delivers such features for a specific folder tree or drive.

When you start an Android device for the first time after a factory reset, you may be prompted if you want to restore your data. If you are, restoring is pretty straightforward. Answer yes. While the exact routines may vary between devices and manufacturers, other forms of restore generally follow some flavor of the following process:

To restore contacts from an SD card:

1. Open the Contacts App.

   If there is an import feature, select it and jump to Step 4.

2. Select Settings from the main menu (or click the Settings icon).

   If you aren’t displaying all contacts, you may need to click the Display menu and select All Contacts.

3. Select Import/Export Contacts (or, if that option is not available, select Manage Contacts and then select Import Contacts on the next screen).
4. Select Import from SD Card.

5. Review the file name for the backup of the Contact list then click OK.

   Contacts are often backed up (or exported to) VCF files.

To restore media (pictures, videos, and audio files) from an SD card:

1. Using File Manager, open the SD card.
2. Click to turn on check boxes next to the file or files that you want to restore.
3. To copy files to the phone’s memory, go to the menu and select Copy ⇒ Internal Storage.
4. Select the folder to which you want to copy the files or create the folder and move into it.
5. Select Copy Here.

Restoring from manual file or folder copying backups

To restore from a manual file or folder copy, just copy the file or folder from the backup to the main data store. (If you are overwriting a file or folder, you may receive a warning from the operating system.)

Disconnect the media on which the backup is located from the main store when you are done.

Utilizing third-party backups of data hosted at third parties

If you utilized the backup capabilities of a third-party provider at which you store data in the cloud or whose cloud-based services you utilize, you may be able to restore your relevant data through an interface provided by the third-party provider.

If you use a third-party cloud-based-service provider and you have not performed backups, you may still be able to restore data. Contact your provider. The provider itself may have backed up the data without notifying you.

While you should never rely on your cloud service provider performing backups that you did not order, if you are in a jam and contact the provider, you may (or may not) be pleasantly surprised to find out that they do have backups from which you can restore.

Network storage

Ideally, when restoring from a network-based backup, you should mount the network drive as read-only to prevent possible corruptions of the backup. Furthermore, be sure to disconnect from the network data store once you are done performing the restoration.

Make sure that whatever mechanism you are using to run the restore (for example, backup software) has the proper network permissions to write to the primary data storage location.

Restoring from a combination of locations

There is no reason to back up to only one location. Restoration, however, typically will utilize backups from only one location at a time. If you do need to restore from backups that are physically situated at more than one location, be extremely careful not to restore the wrong versions of files as some of the files may exist on multiple backups.