Disaster Recovery

• Identify the purpose and characteristics of disaster recovery.

Besides implementing fault-tolerance measures in a network you need to consider disaster recovery—the things to do when your carefully implemented fault-tolerance measures fail. Disaster recovery and fault tolerance are two separate entities, and both are equally important. Disaster recovery is defined as measures that allow a network to return to a working state.

Backups and backup strategies are key components of disaster recovery. The following sections identify the various backup strategies that are commonly used and why these strategies are such an important part of a network administrator's role.

Backup Methods

You can choose from several backup methods. You shouldn't select one at random; you should choose carefully, to match the needs of your organization.

The backup method you choose will most likely be affected by the amount of time you have available. Many organizations have a time window in which backup procedures must be conducted. Outside that window, the backup procedure can impede the functioning of the network by slowing down the server and the network. Organizations with large amounts of data require more time for a backup than those with small amounts of data. Although both small and large organizations require full backups, the strategy each uses will be different. With that in mind, let's look at the various backup methods, which include full backups, incremental backups, and differential backups.

Full Backups

If you have time, a full backup is usually the best type of backup. A full backup copies all the files on the hard disk. In case of disaster, the files from a single backup set can be used to restore the entire system.

Despite the advantages of full backups, they are not always a practical solution. Depending on the amount of data that needs to be backed up, the procedure can take a long time. Many administrators try to run full backups in the off hours, to reduce the impact on the network. Today, many networks do not have off hours, making it difficult to find time to squeeze in full backups.

Full backups are often used as the sole backup method in smaller organizations that have only a few gigabytes of data. Larger organizations that utilize hundreds of gigabytes of data storage are unlikely to rely on full backups as their sole backup strategy.

IN THE FIELD: BACKUPS AND SECURITY Having your entire hard drive stored on a single tape has obvious advantages but also some not-so-obvious disadvantages, including security concerns. A tape holding all your sensitive data can be restored by you or by anyone who has access to the tape. There are well-documented cases of stolen tapes and the resulting stolen data. When you make any backups, you're responsible for storing the tapes in a secure location.

Incremental Backups

An incremental backup is much faster than a full backup because only the files that have changed since the last full or incremental backup are included in it. For example, if you do a full backup on Tuesday and an incremental on Thursday, only the files that have changed since Tuesday will be backed up. Because an incremental backup copies less data than a full backup, backup times are significantly reduced.

On the other hand, incremental backups take longer to restore than full backups. When you are restoring from an incremental backup, you need the last full backup tape and each incremental tape done since the last full backup. In addition, these tapes must be restored in order. Suppose you do a full backup on Friday and incremental backups on Monday, Tuesday, and Wednesday. If the server fails on Thursday, you will need four tapes: Friday's full backup and the three incremental backups.

Differential Backups

Many people confuse differential backups and incremental backups, but they are very different from one another. Whereas an incremental backup backs up everything from the last full or incremental backup, a differential backup backs up only the files that have been created or changed since the last full backup.

When restoring from a differential backup, you need only two tapes: the latest full backup and the latest differential. Depending on how dynamic the data is, the differential backup could still take some time. Essentially, differential backups provide the middle ground between incremental and full backups.

REVIEW BREAK: A Comparison of Backup Methods

The backup software determines what data has changed since the last full backup, by checking a setting known as the archive bit. When a file is created, moved, or changed, the archive bit is set to indicate that the changed file must be backed up.

Full backups do not concern themselves with the archive bit because all data is backed up. However, a full backup resets the archive bit after the files have been copied to the tape. Differential backups use the archive bit but do not clear it because the information is needed for the next differential backup. Incremental backups clear the archive bit so that unnecessary files aren't backed up. Table 10.2 summarizes the characteristics of the different backup methods.

Table 10.2. Comparison of Backup Methods

Method	What Is Backed Up	Restore Procedure	Archive Bit
Full	All data	All data is restored from a single tape.	Does not use the archive bit but clears it after files have been copied to tape
Incremental	All data changed since the last full or incremental backup	The restore procedure requires several tapes: the latest full backup and all incremental tapes since the last full backup.	Uses the archive bit and clears it after a file is saved to disk
Differential	All data changed since the last full backup	The restore procedure requires the latest full backup tape and the latest differential backup tape.	Uses the archive bit but does not clear it

Backup Rotation Schedules

You can use a backup rotation schedule in conjunction with a backup method. Organizations use many different rotations, but most are variations on a single popular rotation strategy: the Grandfather-Father-Son (GFS) rotation.

GFS is the most widely used rotation method. It uses separate tapes for monthly, weekly, and daily backups. A common GFS strategy requires 12 tapes. Four tapes are used for daily backups, Monday through Thursday; these are the son tapes. Five tapes are used for weekly backups, perhaps each Friday; these are the father tapes. Finally, three tapes are used for a monthly rotation; these are the grandfather tapes.

Using the GFS rotation, you can retrieve lost information from the previous day, previous week, and several previous months. Adding tapes to the monthly rotation lets you go back even further to retrieve data. Of course, the further back you go, the less current (and perhaps less usable) the information is. More tapes also make the rotation more complex.

Many organizations don't follow the GFS strategy by the book; instead, they create their own backup regimes. Regardless of the backup strategy used, a well-designed backup rotation is an integral part of system administration and should follow guidelines that allow for several retrieval points.

Backup Best Practices

When you're designing a backup strategy, you should consider some general best practices. These best practices ensure that when you need it, the backup you are depending on will be available:

• Test your backups— After a backup is completed, you have no idea whether the backup was successful and whether you will be able to retrieve needed data from it. Learning this information when your system has crashed is too late. To make sure the backups work, it is important to periodically restore them.

• Confirm the backup logs— Most backup software generates log files after a backup procedure. After a backup is completed, you should read the backup logs to look for any documented errors that may have occurred during the backup procedure. Keep in mind that reading the backup-generated logs is no substitute for occasionally testing a restore. A completely unsuccessful backup might generate no documented errors.

• Label the backup cartridges— When you use many tapes in a rotation, you should label the cartridges to prevent reusing a tape and recording over something you need. The label should include the date of the backup and whether it was a full, incremental, or differential backup.

• Rotate backups offsite— Keeping all the tape backups in the server room or elsewhere in the same location as the server can be a problem. If the server location is damaged (by fire or flood, for example), you could lose all the data on the server as well as all your backups. You should use an off-site tape rotation scheme to store current copies of backups in a secure off-site location.

• Use new tapes— Over time, tape cartridges can wear out and become unreliable. To combat this problem, you should periodically introduce new tapes into the tape rotation and destroy the old tapes.

• Password-protect the backups— As an added measure of security, it is a good idea to password-protect your backups. That way, if they fall into the wrong hands, they are protected by a password.

Designing an effective backup strategy is one of the most important considerations for a network administrator, and therefore, it is an important topic area for the Network+ exam. Remember that the preservation of data is a foremost consideration when approaching network management.