CompTIA A+ Core Certification: Operational Procedures - Workstation Backup and Recovery Methods

220-1102: Objective 4.3: Given a scenario, implement workstation backup and recovery methods.
Data is usually the most important asset that a company has to protect. Loss or breach of data can paralyze a company and bring it down. Disasters, by definition, are sudden and cause great damage. They are often nature driven and cannot be avoided. The best an organization can hope for in planning for a disaster is to have a system that can fail well and provide a reasonable path to recovery.

Backup and Recovery
Four main types of data backup exist:
- Full: A full backup backs up the entire contents of the computer or selected drive to another local or network location. Because every file is copied, this backup takes the longest and uses the most storage.
- Incremental: These backups copy only data that has changed since the last backup. If a full backup is performed every Saturday, then an incremental backup could be run each day of the week, recording one day of activity each time. This way, backups are current but a full backup does not have to run each day.
- Differential: These backups record changed data since the last full backup. These backups can be done often to ensure that data backups are very current.
A differential backup includes all data that has changed since the last full backup, regardless of whether or when the last differential backup was made, because this backup does not reset the archive bit, a file attribute used to track incremental changes to files for the purpose of the backup. An incremental backup includes all the data that has changed since the last incremental backup. An incremental backup is incomplete for full recovery without a valid full backup and all incremental backups since the last full backup. For example, if the server dies on Thursday, four tapes are needed: the full backup from Friday and the incremental tapes from Monday, Tuesday, and Wednesday. A full backup copies all selected files and resets the archive bit.
- Synthetic: These backups are similar to full backups, except that they are actually reconstructed in software from a full backup in the past and then modified with the incremental backups that have occurred since the full backup. The benefit is reduced storage needs for backup data.

Backup Testing
Testing backups is important: The worst time to find out that your scheduled backups are not working properly is when they are needed to recover data. Testing backups ensures that the needed data is available when a backup is necessary. It also enables IT staff to practice restoration so that they have this skill in place when it is most needed.
Each organization must determine the necessary frequency of testing. Testing not just data, but also infrastructure such as backup power supplies, is a good plan.
In the days when tape backups were run, testing backups was a time-consuming task. Thanks to cloud storage, network-attached storage (NAS) solutions, and virtualization, the process is much easier today.

Account Recovery Options
It is easy to lose track of all the accounts people keep in their daily digital lives. As we increase the roles of digital work and recreation in our daily lives with shopping, banking, TV subscriptions, online storage, medical records, and access to networks where we work, the need for accounts and authentication becomes more vital. Losing access to an account can result in anything from a mere inconvenience that requires a password recovery process, to a full disaster after being cut off from financial or medical services.
Account recovery can take many forms, depending on the account and who is responsible for its safekeeping. No matter who is responsible, smart account holders know how to get out of trouble before trouble occurs. Having a plan in place to recover your digital life if laptops or phones are lost, stolen, or destroyed allows you to recover quickly and keep records secure until the devices are back online.

Most personal accounts from vendors can be recovered in one of several ways:
- Submitting an account email address on the login page and having a password recovery link sent via email
- Having a tech support agent reset an account with a temporary password that must be reset upon login
- Answering secret questions with answers provided during account setup

For example, subscribers to Microsoft online user accounts in Windows can have their accounts shut down if Microsoft sees signs of unusual activity. When an account is disabled, users can sign into their Microsoft account and follow instructions to get a security code. Similarly, a bank might lock down a credit card if it sees unusual purchasing patterns; then either the bank contacts the customer or the account holder must contact a bank agent to verify purchases.
At work, users count on the system administrator to help them get back online. Windows Active Directory and nearly all other enterprise-level server solutions have administrative tools to recover deleted user accounts.
Data is fragile by nature, and many problems can arise, resulting in corrupt or unusable data on a computer or mobile device. Our increasing reliance on data makes backups essential even for home users. Fortunately, backing up any computing device is easier than ever.
Windows, Linux, and macOS have systems in place to make backing up and, if necessary, restoring data a fairly routine process. Several ways of backing up images are available, including backing up to the cloud, using a backup service, and creating a network-attached storage (NAS) system for a network.

Three levels of data backup exist. They are listed here and described in more detail in the following sections:
- System image: Making a copy of an entire disk, including the Windows image
- File-level backup: Backing up or archiving files such as documents, reports, and pictures
- Critical application backup: Backing up applications needed to restore business after a disaster

System Image
A system image backup includes everything on the drive, including the operating system (which is the system image). This backup can be used to restore a failed computer if a failure occurs. This is a full backup and is also known as a “snapshot” of everything on a drive at a given time. The time of the snapshot becomes the restore point in the recovery process.
After the OS is installed, the data files are recovered. If backup space is an issue, doing a system image backup might not be the best choice: The OS takes up considerable space, and there is likely already a copy of the OS that can simply be reinstalled. In recent years, however, storage prices have dropped and the OS process for backup has been simplified, so backing up with a system image is a more common choice now. “Software Troubleshooting” details this process.

File-Level Backup
Files are generally the data saved by users when they use applications. File backups can be documents, media files (such as video or music), and pictures. Keeping just the data takes up less space than backing up the applications as well. As with the OS, most applications can be restored from the original disks or downloaded again; then the files can be recovered. 

Critical Applications
Determining what files are considered critical varies depending on the organization, but generally these are the first files that will be restored after a disaster, to get operations up and running again. This can be accomplished with a system image or with virtual machines (VMs) that can be loaded to run quickly.

Backup Rotation Schemes
It is important to manage and organize data backups in a manner that allows reliable access to current and historical data. To make sure that data is safe and accessible, plan for where and when data will be archived, as explained in the following sections.

Onsite vs. Offsite Backups
Where data is stored is a vital consideration. Storing it in at least two places prevents a potential data loss due to fire, flood, human error, or system failures. Keeping a copy of backed-up data onsite ensures easy access on a daily basis. Onsite storage can be on servers, stored hard drives, backup tapes, or other storage media.
Keeping a redundant copy of backed-up data offsite guards against a physical disaster wiping out important data. Offsite storage can be in a cloud or could involve backed-up media in another data center far enough away that it is not impacted by the same fires, floods, or storms that could harm the primary data center. Keeping the remote data offline also protects against hacking.
The easiest way to back up data on workstations is to use an external drive (hard drive or USB flash drive) with a redundant backup on the cloud.
For an external drive backup, mount a USB flash drive (or an external hard drive) and drag the files into the drive window. Unmount/eject the USB drive and store the flash drive. Then copy the files to a flash drive for backup.
The Windows Backup and File History utilities and Time Machine in macOS easily back up files and system images to external hard drives. With an external hard drive plugged into a USB port, start the backup utility and select the drive. When the backup is complete, store the drive in a safe, dry environment until the next backup is to be performed. Scheduled backups should be run at times when the system is idle, such as overnight and on weekends.

The figure below shows the first steps of Windows 10 Backup using the File History utility to store or retrieve files.


Windows 10 Backup

macOS includes Time Machine, an automatic backup utility that can create hourly backups for 24 hours and that saves those hourly backups as daily backups and maintains weekly and monthly versions. Go to System Preferences to enable and configure Time Machine:
Step 1. Connect a suitable external disk to a macOS system (see Figure below). In this example, Rick Bup is an external drive connected via USB.


macOS Time Machine Backup Utility

Step 2. Click Backup Disk.
Step 3. In the new window that appears, check the Encrypt Backups box to protect the backup (see the insert of Figure 9-5).


Selecting and Encrypting an External Disk (Rick Bup) in Time Machine

Step 4. Enter a password, confirm it, and enter a password hint. Click Encrypt Disk.
Step 5. Make sure Time Machine is turned on. After the selected disk is encrypted, the backup starts.

Linux includes several utilities that can be used for backups. These include the command-line tar and rsync utilities. Others, including grsync (which is a GUI for rsync), duplicity (which is available as a command-line utility and also as a GUI called Deja Dup), are available from the repository for a Linux distribution or from the vendors.


Note: The BackupYourSystem page on Ubuntu Linux (https://help.ubuntu.com/community/BackupYourSystem) provides a large list of command-line and GUI-based backup tools that also work with other Linux distributions.
The process of backing up files or images to the cloud can be managed by a cloud backup service that syncs the drives on a schedule you choose.

The following are common names in the increasingly crowded cloud provider arena:
- Amazon Drive
- Dropbox
- Google Drive
- OneDrive app in Windows

These options provide varying levels of storage space, encryption services, and price points. Each has an introductory level for personal use that provides free or discounted storage space and bigger plans for business-level customers.
All of these services mimic a flash drive or external drive by mounting a virtual drive on the desktop for accessing files. As with any other drive window on the computer, files can be copied or moved by simply dragging them to or from the cloud drive window. User data can also be accessed via the provider’s web page.

Table: Comparing Cloud vs. Local Storage

As you can see from the Table above, there are increasing advantages to using the cloud, but the benefits of secure local storage have not completely disappeared. Add to this mix the possibility of internal clouds, and the lines become even less clear. A good backup plan is not restricted to either of these options and instead involves taking advantage of the benefits of each.

Grandfather-Father-Son (GFS) Backup Rotational Scheme
The grandfather-father-son (GFS) rotation method describes keeping three different generations, or types of backups, in various places. The name is simply an easy way to remember that full backups (grandfather—perhaps a monthly backup stored redundantly offsite) can be combined with a weekly backup (father—also sent offsite) and a daily incremental backup (son). This scheme is popular because of the minimal use of time and storage for the smaller backups.
Increased use of cloud storage simplifies the process of offsite storage so that storing all three backup types both onsite and offsite can be easily done.

3-2-1 Backup Rotational Rule
The 3-2-1 backup rule or scheme is an easy way to define the practice of keeping backups:
- 3: Keep one primary copy plus two backup copies of data.
- 2: Keep two methods of storage for the data (for example, local and cloud).
- 1: Keep one local backup offsite, in case of fire or storm damage to a facility.