Module 5: Data Recovery and Backups

What are the key steps in planning for data recovery?

1. Identify critical data and devices.

2. Develop a documented disaster-recovery procedure.

3. Schedule regular backups and post-mortems.

4. Test recovery process and update plan after incidents.

• Lab Activity: Draft a recovery plan for your lab’s file share VM; simulate a disk failure and follow your plan to restore data.

What factors influence the choice between on-site vs. off-site and cloud vs. local backups?

• Retention period, data volume, growth projections.

• Access speed, transmission security (encryption in transit/rest).

• Maintenance overhead and cost.

Lab Activity: Configure rsync to back up a directory on one VM to another VM’s USB volume; enable SSH encryption.

How do full and differential backups differ, and when should each be used?

• Full: captures all data; slower, larger.

• Differential: captures changes since last full; faster incremental restores without chain complexity.

• Best practice: weekly full + daily differential.

• Lab Activity: Use rsync --link-dest to simulate full and differential backups of /etc on a Linux VM.

Why is RAID not a substitute for backups?

RAID provides redundancy (disk-failure tolerance) and performance, but does not protect against accidental deletion, corruption, or disaster.

• Lab Activity: Build a RAID 1 array with two virtual disks on a Linux VM; test disk failure tolerance and then delete a test file to show data isn’t recoverable without a backup.

Name three backup tools and their primary platforms.

• rsync: efficient file sync over SSH (Linux/macOS).

• Time Machine: block-level, versioned backups (macOS).

• Windows Backup and Restore: image-based and file-level backups (Windows).

• Lab Activity:

  • On Linux: back up /home with rsync.

  • On macOS or Linux VM: enable Time Machine to a network share.

  • On Windows VM: configure a daily file backup to a secondary disk.
    

Why and how should you test backups regularly?

• Ensures restore procedures work, catches overlooked errors.

• Document step-by-step restore instructions for any technician.

• Lab Activity: Restore a backed-up folder from your rsync or Windows backup and verify file integrity; store a written procedure with screenshots.

What components must a comprehensive disaster recovery plan include?

1. Risk assessment and asset inventory.

2. Backup and recovery system definitions.

3. Detection and alert measures (e.g., UPS, sensors).

4. Roles, responsibilities, and communication procedures.

5. Post-mortem and plan revision process.

Create a written DR plan for your lab, assign roles, and schedule a mock-failover exercise.

What are preventative, detection, and corrective methods in disaster recovery?

• Preventative: redundant power (UPS), regular backups.

• Detection: environmental sensors, alerts for failures.

• Corrective: restore from backup, rebuild systems, failover to secondary resources.

• Lab Activity: Simulate a power-loss event on a VM (disable its network), then perform corrective recovery and document steps.

What key sections are in a post-mortem report?

1. Executive summary (incident, duration, impact).

2. Detailed timeline (timestamps, actions taken).

3. Root cause analysis.

4. Resolution steps and rationale.

5. Lessons learned and improvement actions.

• Lab Activity: After your backup-restore test, draft a post-mortem using this structure and share it with a study partner.

Which cloud services can end users employ for backup and sync?

Dropbox, Google Drive, and iCloud offer file versioning, cross-device sync, and off-site storage.

• Lab Activity: Install one of these clients on a VM, sync a test folder, delete it locally, and restore from the cloud.