What's your backup position?

In the event of a disaster, every person and organization should have a backup plan to recover important information

Backups may not be sexy or new, but they are something we take for granted. In information technology, the term refers to making copies of data so the copies may be used to restore information in case of a data loss. Whether you have a home PC or are responsible for data in your organization, periodically you must review your backup strategy to ensure it meets your needs.

Technology lets us automate or simplify many tasks, and we depend on it to store and organize much of the data we own. Look at examples of data we all have and use (see chart above).

Some data can be recreated, some are irreplaceable. An appropriate backup strategy is key to any disaster recovery plan. Without a valid backup, your business could suffer irreparable damage through the loss of client data or other information in the event of fire, flood, hurricane, tornado, earthquake or other disasters.

Even without a disaster, valuable information or data can be lost. According to a study by Carnegie Mellon University and experience by Google data centres, disks fail and they can fail long before their "mean time to failure." Studies show this to be true for both inexpensive consumer (ATA and SATA) and expensive (SCSI and Fibre Channel) disks used by high-end computer manufacturers for servers and disk arrays.

Full guidance on backups is beyond the scope of this article; if you are evaluating your backup position, you will need additional research. However, if you are looking for basic guidelines, you are in the right place.

Backup versus archive

In some cases all you need is an archive of documents or files. An archive is simply a copy of files you want to keep, those files you can't afford to lose, be they financial data, correspondence or photos.

Archiving is easy. Simply copy the data to any external media such as an external hard drive, flash memory, CD, DVD, even floppy disks, though with today's data sizes and the limited availability of floppy drives in new machines, floppy disks are not recommended.

When you archive data, test its usefulness by try ing to read the media on another machine or system. Because you can read the data on the machine that created the archive, there is no guarantee that the data can be read on another machine should this one become unavailable. Testing readability on another machine is critical.

On the personal front, an archive copy of correspondence, documents, financial information and photos stored on a CD or DVD and kept at the office could be the appropriate backup situation for you. Technology today allows this. Just think - before computers, this type of information would have been paper-based and destroyed and lost forever in the event of a fire or flood.

Windows backup things you should know

If you have a full system backup in Windows XP or Windows Server 2003 and your machine dies, chances are you won't be able to restore the system. The full system backup will allow you to rebuild the exact machine, but if that particular hardware is not available, you may not be able to recover the system on a new PC. This is because a Windows Backup includes drivers and software unique to the machine and this may prevent the new system from working properly.

All kinds of problems can occur should this happen. You may have difficulty recovering your mail (Outlook on PCs and Exchange on servers), Active Directory information about users and computers on your network, etc. In some cases you will need to re-install the operating system and all applications on the new machine and restore the data from the backup. With today's software licensing and activation methods, it may not be easy to re-install the software on another machine. The only way to ensure you are covered is to test your backup on another system from time to time.

In Windows Vista and in Windows Server 2008, backups created with NTBackup included in Windows 2000, XP and Windows Server 2003 require that a special Microsoft tool be downloaded and used to restore the data. NTBackup, the longstanding Windows backup tool, is no longer included in Vista and Server 2008.

In Windows Vista, Microsoft has created two new backups: Windows Complete PC Backup and the Backup Files Wizard. As the names imply, the two backups are for different purposes and keep the data separate from the system. In the event of a full system failure, the Windows Complete PC backup can restore programs and data, however should a specific file be required, the backup files Wizard can be used to recover the lost files.

In Windows XP and Vista, you can use the Windows Easy Transfer Wizard, which lets you transfer data to the new PC. In an enterprise setting, you can use the Windows User State Migration Tool to create a backup file, which will maintain all user files and settings allowing you to re-create the user machine, regardless of the hardware. These tools help minimize down time and allow the user to retain most settings such as mail, desktop wallpaper and the like.

Windows Server 2008 Backup shows promise in the area of restoring to a different machine; time will tell.

If you use a recent version of Windows or if you only need to restore an earlier version of a specific file, you can use Shadow Copy or the Volume Snapshot Service. VSS allows taking manual or automatic backup copies or snapshots of a file or folder on a specific volume at a specific point in time. It is used by NTBackup and the Volume Shadow Copy service to backup files. In Windows Vista, it is used by Vista's backup utility, System Restore and the Previous Versions feature. Although technically not a backup utility, it can help you restore a file to its previous version in case of accidental erasure or modification.

All of this is simply to highlight issues with backups under Windows, even if we are using the supported tools. Backup is never simple and if not tested, the process could be tedious, useless or less effective than anticipated.

Backup medium

Today the choice of backup medium is almost limitless. Tape is the medium of choice in large data centres as it's easy to store and move, but some organizations are re-evaluating this position. Storage media include magnetic tape, hard disks, optical disks, floppy disks, flash memory, remote backup services, virtual tape libraries, branch-office backup or copies and mirroring. (For a detailed definition of these backup media, please see www.CAmagazine.com/backup.)

Regardless of the data repository model or data storage media backups, a balance needs to be struck between accessibility, security and cost.

Encryption

As discussed previously, data encryption is important to ensure personal or business data is not compromised. Most backup software can encrypt the data as it is written to the media. You need to evaluate the need for encryption of your backup data. Bear in mind you usually store important data on the backup-can you risk it being compromised?

If you want to archive your data to CD or DVD, using a file archiving utility such as current versions of WinZip allows for strong file encryption thereby protecting your valuable data. In corporate environments, most commercial backup software allows for encrypted backups.

Some risks

Data stored offsite could be compromised by competitors or through carelessness. Proper security measures need to be taken to protect all data, including backups.

The time to find out if your backup is usable is not in the event of a disaster. Test backups periodically to ensure they can be read and restored to your system or to another machine.

You could have the best backup device in the world, but if you can't get a similar or compatible backup device within a reasonable period of time during a disaster or failure, your backup could be compromised or even useless.

Backups should be in a secure remote location. Keeping current backups on site could be of little use if a disaster should occur.

Are your recovery processes documented? You should be ready in case centre staff are unavailable and you need your system restored. A full backup/restore scenario includes data, equipment, process and people.

Best practice checklist

In order to see if you have a proper backup, check the following points to evaluate the state of your backups:

* the more important the data stored the greater the need is for backing it up;

* a backup is only as reliable as the ability to restore it;

* never store backup near the original. Fire, flood or earthquake will destroy any backups along with everything else;

* an automated backup and scheduling strategy should be used. Manual backups rely on human intervention and can be subject to error or simply forgotten;

* backups will fail for a variety of reasons. A testing or monitoring strategy is a vital part of any backup plan;

* if data is sensitive, it should be encrypted - especially if it is stored offsite, if you use a remote backup solution or if the data is out of your control.

This is just a short expose on backups. You need to evaluate how they fit into your organization - don't be caught without a backup.

[Author Affiliation]

Yves Godbout, CA*IT, CA*CISA, is the director of IT services with the Office of the Auditor General of Canada and has extensive experience in information technologies as they apply to the enterprise and in audit. He is the chair of the CICA Alliance for Excellence in Information Technology. Godbout is also Technical editor for technology. He can be reached at godbouy@computradcom