Microsoft Windows OS and Application Backup and Recovery
Most of your efforts to secure information will focus on the primary copy of your information. The primary copy of any piece of information is the copy you use most frequently. You’ll spend time and effort ensuring your organization’s information is accessible only by authorized users. You’ll carefully control what users can do with and to your information. But what happens if the primary copy of any data gets damaged or destroyed? What if a fire, flood, or other disaster destroys the computer where information resides? Or what if a worm deletes many of your important documents? How do you recover if existing controls do not protect your data?
The Need for Backups
The answer to all of these issues is to have access to a current secondary copy of the information you lost. While that solution may sound simple, it takes some thought and planning to provide a usable alternative. A valid backup is a crucial part of an organization’s ability to recover from losing data. A backup is a defined collection of copies of files you create in case the primary copies of the files are damaged or destroyed. There are many ways you can lose data. Not all situations that result in losing data are major disasters. You have already seen a few situations that may cause you to lose data. FIGURE 8-1 shows some of the reasons you may lose data:
FIGURE 8-1
Reasons for data loss.
© Jones & Bartlett Learning.
Hardware errors—Hard disks or disk controllers can fail. Hardware failures may occur slowly, introducing errors into your data files over time. Equipment can also be lost or stolen. Hundreds of thousands of laptops are left in airports and taxicabs each year.
Software errors—Software bugs and poorly written software can cause you to lose data you thought was safe.
Malicious software—Many types of malware damage or delete files to alter or destroy data.
User actions—Users can take actions that damage or destroy data. Users can misuse application software or OS utilities to cause data loss. Data loss because of user actions can be either intentional or accidental. Each type of motivation requires a different type of control.
Attacks—Successful attacks on your information systems can cause substantial data loss. Many of the controls you implement keep attackers from successfully harming your information’s security.
Environmental issues—Many issues with the computing environment can cause computers to fail and possibly damage data. Air-conditioning system failures can cause computers to overheat and possibly result in hardware damage. Fire suppressants and sprinkler systems can damage computers as well. Power spikes and fluctuations can also cause hardware damage that could result in losing data.
Natural disasters—This is the category most people consider first when discussing reasons for backups. Disasters such as fires, floods, tornadoes, and earthquakes can cause substantial damage and result in data loss. Any large-scale disaster has the potential to damage your data.
Anytime you lose the primary copy of your data, you have two choices:
Reconstruct the data.
Recover the data from a secondary source.
In most cases, reconstructing data is the last resort. Duplicating the work effort required to reconstruct data is often counterproductive, wasteful, and expensive. It is generally faster and easier to recover lost data from a secondary copy, or a backup. You must have created a secondary copy of your data prior to the loss for this option to be viable. A scheduled backup is the most common method to create secondary copies of important data to use in the case of primary data loss. A backup doesn’t guarantee that you’ll be able to recover all the data you’ve lost, but it does make recovery a real possibility.
The Backup Process
The process to create a backup is fairly simple. You copy the files you want to duplicate to a target location. Creating an effective backup plan that enables the most recovery options, however, is not so simple and takes time to design. The backup planning process starts with a series of questions to decide how to conduct the actual backup. Common questions include:
Which files or folders will you back up?
Will you use a static list of files or dynamically identify the items for backup?
Where will the backed-up files be copied?
Will you use removable media?
Does the backup require human intervention?
How will you label and identify backup media?
What controls will you use to protect the C-I-A properties of the backup media?
How frequently will you create a backup?
Will you back up all your data each time, or just what changed since the last backup?
How many generations of backups will you keep?
How will you use the backup to recover lost data?
The Restore Process
The real reason for creating any backup is to have the option of restoring if you lose any primary data. A restore operation is the process of copying secondary copies of files back to their primary locations. The most common reason to restore files is to replace damaged or missing data.
The restore process involves deciding whether to copy all files and folders from the backup media back to their original locations or only some files and folders. First, identify the files and folders you want to restore. Then, open a restore utility that is compatible with the backup image you created and start the process. There are several important considerations when you choose to restore data from a backup. Answer these three questions to ensure you understand the impact of restoring data to a previous state:
How long will it take to restore the selected data?
What data will I lose in the restore process?
Will I be able to use the data I restore?
All three questions may seem minor, but they have a large impact on how effective your backup policy will be. The first question is one that many IT personnel and users fail to appreciate. Many organizations choose to create complete backup images anytime they create backups. You can be sure you don’t miss any files or folders when you back up everything.
The problem with complete backups is that they tend to take longer than backing up only selected files and folders, and they will certainly take longer to restore. Taking longer to create a backup can have other effects as well. If your backups take a long time to complete and it slows down your system to create the backup, you may choose to back up less frequently. That means more time passes, and you make more changes, between backups. The other part of this concern is how long it takes to restore lost data. You must define a target goal for how long it should take to recover from an interruption. Otherwise, it may be difficult to decide on the best recovery option.
Most organizations set a recovery time objective (RTO) for critical resources. The RTO is the amount of time it should take to recover a resource and bring it back to normal operation. Assume the RTO for a specific server is 3 hours. If a full restore takes 4 hours but you can reenter and verify the lost data in 2 hours, a restore is not the most efficient choice.
The answer to the second question can often lead to many more questions. A backup is a snapshot of a collection of files at the time you created the backup. As long as you make no changes after you create the backup, you can recover all of your data. However, if you make any changes to data files after you create the backup, you risk losing those changes.
The most common reason to restore files is to recover from damaged or lost data. If you restore one or more files from backup media, you will lose any changes made to those files since creating the backup. Waiting longer between backups means you can potentially lose more data if you have to restore files. Carefully consider how you will reconstruct data created or changed since your last backup if you lose primary copies of your data. The common perception that simply restoring the most recent backup will fix everything is not accurate.
The last question addresses data that tend to change very frequently. Most organizations use database management systems to manage large amounts of data. Database files are likely updated frequently and may change during the backup process. Other large files may change while copying during a backup. When a file changes as it is being copied, it may lose its integrity. Most database vendors provide specialized backup utilities for database files to ensure the data maintain its integrity. Get to know your applications and any special requirements for including large files in backup operations. You don’t want to find out your backed-up files aren’t usable.
The choice of restore utilities depends on which utility you used to create the backup image. Utilities must be compatible with backups. Beyond basic compatibility, the process depends on the specific options your backup and restore utility provides. In many cases, the restore utility copies everything from the backup media to a location on your hard disk. When you complete a well-planned restore operation, you’ll have to take a few additional steps to get running again.