All right, introduction to data backup.
Data backup, absolutely essential.
If your primary fails, you got to have a backup.
And we're talking about digital and physical paper and computer records.
It's used mainly for two purposes, to
reinstate the system to its normal working state after damage
or recover data information following data loss or corruption.
So you're also going to have onsite and off site restoration copies.
And we'll talk a lot more about that in
our business continuity and disaster recovery discussion in a later module.
A successful backup strategy necessary to
avoid severe damage to an organization's assets.
You also want to consider your recovery
point objectives, how recent the backups need to be.
You also want to consider, again, onsite, off site, transportation.
You want to know to consider your alternate sites, your hot sites,
subscription sites, cold sites, that thing.
And again, we're going to talk more about
that in disaster recovery and business continuity planning.
Your data backup strategy plan starts with, beginning the module, we already
identified the need to identify critical business data, selecting the backup media,
selecting a backup technology, identifying appropriate rate levels, which we'll be
talking about later in this module, selecting an appropriate backup method,
selecting the backup types, choosing the right backup solution,
and very important, conducting a recovery drill test.
If you have not tested your ability to
restore data, you do not have a solid backup plan.
Recovery to your primary systems, recovery to your alternate systems.
Every so often validating the integrity of
your backups, random restorations just to ensure that everything is restorable.
There is a story in a textbook years ago where an organization was backing up.
They had a courier transporting their
backups to an off site location, and this was in New York City.
The courier took the subway each day and set the satchel down next to an electrical
transformer in the subway station and was corrupting all the backups.
They had never tested the ability to restore the backups.
When their data sets finally failed, none
of the backups were good and they lost everything.
That's a horror story you do not want to experience.
Really important, periodically test your ability to recover.
Let's look at the backup media.
The criteria for choosing your backup
media is based on reliability, usability, speed, cost, and availability.
And historically, tape has been a really good option.
It gets high capacity, relatively
inexpensive, reliable, but the problem with tape is it's slow, painfully slow.
So a couple of options, DVDs, jukeboxes, CD jukeboxes, that thing.
Optical disks, relatively decent capacity,
about 200 gigs, depending on the version, Blu ray, HD DVD.
Advantage is affordable, easy to store and transport.
Disadvantage is lots of manual swaps.
Recording and verifying the backup is relatively slow.
Portable hard drives.
Love my portable drives.
I've got two of these little Samsung s.
I love this thing.
Little USB 3.0 thunderbolt interface, 2 terabytes capacity.
Fits in the palm of my hand.
I'm actually recording to one right now on my DSLR camera.
Absolutely love it.
All my virtual machine backups and everything are right here, ready to rock.
Love it.
High speed, relatively inexpensive, and very, very fast recovery.
Tape drives.
Again, capacity, theoretically no limit.
They can be expensive, drives and the tapes.
Not necessarily more expensive than hard
disk, but honestly, I haven't priced tapes in an awfully long time.
Last time I was responsible for my
organization's backups would have been about 2001.
I can't say I miss it much.
The rite of passage.
But we had a really temperamental backup
suite for our Windows servers and a lot of inconsistency to the backup.
I was constantly worrying whether or not they were going to run or they were going
to run successfully the next time and the rotation schemes and so forth.
It's been a while, but I'm impressed amount.
We used DAT and DLT at that point, quarter
inch cartridge, a bunch of other tape formats.
A redundant array of independent disks or
inexpensive disks, depending on what book you're reading.
But Raid is the use of multiple physical
disks in a single logical configuration for one or both of two purposes.
That work? One or both.
Performance and fault tolerance.
You're combining multiple disks to increase the right throughput performance
or to give redundancy and fault tolerance, duplicate copies, or parity information.
Raid has six levels.
Actually, there's a seventh level that was more proprietary.
We have Raid 0 through Raid 6.
Actually, seven levels, eight, if you call the storage computing corporations version
about level, which again is fairly proprietary.
But there's a couple levels that we don't
really speak of, they didn't really catch on, weren't really widely used.
So Raid 0, Raid 1, there was a Raid 2, there's a Raid 3.
There was a Raid 4.
Raid 5, Raid 6, Raid 10, Raid 50, and
various combinations of different Raid versions.
All right, so striping, parity, and
mirroring are the three basic flavors of Raid configurations.
Let's go through them here a little bit.
The Raid storage architecture consists of
a Raid controller, and the Raid controller manages the array of physical drives.
Now, Raid can be both hardware or software.
Hardware is typically better performance.
It reports the entire volume of the system as a single unit.
It's again, high speed throughput,
supports hot swapping, a lot of advantages.
Software based Raid is the operating
systemallocating cycles to managing the Raid array.
It also doesn't allow for things like hot swapping.
Your performance is going to be a lot less with software based Raid.
But the interfaces, IDE, SATA or SCSI,
these are the different technologies for communicating with the drive, the
controller technologies, integrated device electronics, serial attached storage,
SCSI, SATA, PATA, SCSI, and then you've got a couple of other flavors, fiber
channel and things like that, which are really more for sand devices.
Typically, one of those three types of interfaces.
A multi port memory controller provides access to a memory bank, which helps to
achieve high efficiency with random address accesses.
Anytime you combine memory cash with hard
drive performance, you've got a hybrid synergy going on there.
Then SDRAM, Dynamic Random access memory, synchronized with the CPU clock speed.
Sdram in general is not just for Raid.
When it's synchronized
versus non synchronized, it runs in sync with the CPU clock speed.
You typically have multiples or variants of that.
I also like static RAM and dynamic RAM,
capacitors versus transistors, lots of different flavors of RAM.
You'll see here we got Rambus and a couple of other flavors of RAM.
We're not going to pick those apart too much right now.
Then the rate levels.
R ate level zero.
Zero is disk striping, which there's a strip through zero in computer lingo.
It gives you zero fault tolerance.
When you strip, you're striping data
evenly A, B, C, D, E, F, and so forth across two disks.
There's no duplicity, there's no
redundancy, but it increases performance since you've got two drives doing the work
of one, you're distributing the workload across two.
Problem with this is if you lose one drive, you lose your entire volume.
Half your data is gone, there's no way to get it back.
I actually lost an MP 3 collection, which I took a considerable amount of time
putting together to a software based Raid stripe, and I haven't trusted it ever
since, so should have had a backup for that.
All right, so Raid 0, disk striping, that increases performance.
All right, Raid level 1, disk mirroring.
This gives us fault tolerance.
So Raid level one is mirroring the same data to two drives.
A and A, B and B, C and C, D and D, disk zero and disk one.
You have a 50 % storage overhead, you have
a fault tolerant component, but not really performance.
Actually, you get potentially a negligible gain in read operations.
We don't really rate it that way.
And if you lose one drive, no worries, mate, we've got the other.
That's the whole purpose of a mirrored volume.
A lot of times operating systems will be mirrored to mirrored volume.
One fails, the other one continues to run.
You can restore the mirror with the failed drive is being replaced.
Boom, you rebuild the mirror.
All right, so fault tolerance, but not performance.
There is a grade level two.
We're not going to worry about it.
Didn't really get used much.
There was error correcting code.
Grade level three is disk striping with parity.
Disk striping with parity is a dedicated parity drive.
We're getting both fault tolerance and performance out of grade level 3.
You're striping the data evenly across the
volume and you're putting parity calculations on a dedicated drive.
The idea here is if you lost a drive, you
could rebuild it with the remaining data sets and the parity calculation.
So one drive fails, it can be replaced based on the parity information.
But the parity information was stored on a dedicated drive.
So the performance of that is not quite what you would see with a grade level
five, which is block interleaved distributed parity.
Now your striping and your parity
information is written across multiple drives.
The idea here is that the parity
information is staggered, better performance.
You can also continue to limp along and reduce performance if one drive fails
because you can rebuild the data with the parity information on the fly.
So one drive fails, no worries, it can be replaced and restored.
Two drives fail, though, data, data, data, white, white.
That's supposed to be a Pacman dying sound and you're out of business.
A raid level six, which we're not going to really talk about directly, but that's a
double distributed parity, redundant parity.
Now you can lose two drives in your set
and still limp along and reduce performance.
Fault, tolerance, and performance for the
raid level threes and the grade level fives.
Grade level 10, blocks, striped, and mirrored.
That's just a combination of two raid types.
You've got a mirrored stripe or a striped mirror.
Mirror 1, stripe 0, grade 10.
Striped mirror, 0 plus 1.
You'll see a couple of different variations of that.
There's also things like grade 15, which
would be a mirrored grade 5 volume, get the idea?
A combination of two or more.
We're at level 50.
Mirroring and striping across multiple grade levels.
That's actually a striped grade 5 volume. You get the idea.
Combination of multiple types of grade.
If it's double digits, it's a combination of two or more.
Striping in grade 5. The mirroring doesn't quite fit.
Striping and raid five.
All right, storage area networks.
Stored during networks are a network
appliance, number one, and the infrastructure, the network switches,
fiber channel adapters, and so forth to communicate with it.
Back in the early days of lower speed
Ethernet, 100 megabit, that thing, storage area networks were an advantage
over network attached storage because of the throughput.
You used fiber channel cards, fiber channels were high speed access.
You had fiber switches.
They all connected to a centralized sand device, and they were a non local disk
subsystem that was used as an alternative to local disk subsystems.
Now you have centralization of your storage, your network.
Nowadays, your sand could be achieved through gigabit Ethernet.
It's got pretty good throughput to it.
You don't necessarily have to have the
fiber switches and so forth to get a pretty decent performing network.
Actually, at that point, it'd just be a network attached storage.
Network attached storage is really nothing
more than a drive array with a network connection.
You got an IP address,
you got a controller, you've got Ethernet connection, file based data storage
service on a dedicated computer appliance, high performance file server, and again,
you're sharing everything from a centralized location.
You can build your own network attached storage arrays.
Selecting an appropriate backup method.
Backup method is based on its cost and
ability according to organization's requirements.
A hot backup or online is ready to go.
The advantages is immediate data backup, switchover is possible.
Disadvantage, way more expensive.
You've got a duplicate device or drive that's being used.
Cold backups or offlines.
Backup, the data when the application
database is not running, not available users.
Use with service level down time is allowed and a full backup is required.
Advantage, least expensive.
Disadvantage, switching over requires additional time.
A warm backup, we'll call that nearline,
combination of both, less expensive than a hot, switching over,
takes less time than a cold, but more time than a hot.
Disadvantage, less accessible than a hot backup.
All right, so cost, restorability.
Again, you got a little give and take between the two.
All right, choosing the backup location,
an onsite data backup has the advantage of being immediately restorable.
Problem with onsite data backups, though, is let's say that the facility is wiped
out, the onsite data backup gets wiped out with the facility.
And off site, the advantage is that the
data is secured from physical security threats like fire, floods, etc.
Remote locations, fireproof, indestructible saves.
The cloud data backup, pretty common these days.
Storing backup data by an online backup provider.
The advantage is that it is encrypted, free from physical security threats.
It can be accessed from anywhere and the
cloud provider will be backing up your data as part of their service offer.
On site, off site and cloud data backups.
Types of backup.
You've got the full normal data backup,
you've got a differential data backup, and you've got an incremental data
backup. right, so I'm going to do my standard whiteboard discussion of full
incrementals, normals, copies, one offs, dailies.
It used to be that you couldn't back up a file while it was open.
Nowadays, we create a snapshot of the file, we back it up anyway.
But back in the day, you had to have a
file closed, not being access to back it up.
So imagine that you got a backup set that takes, say, 27 hours to complete backup.
A lot of data. You can't really run it every night of the
week because you'd be constantly backing up into production hours.
What we come up with is a supplemental
backup scheme where you create full backups, say, on the weekend.
Imagine we got Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday.
Imagine you start a full backup on Saturday and it completes on the Sunday.
The full backup backs up everything,
regardless of the status of the archive bit.
It's the archive bit.
That's a file attribute that gets reset
when the file is backed up and it flags when the file gets modified.
It's used as a flag to say, Hey, this file is changed.
It needs to be backed up.
The behavior in relation to the archive
bit is a concern and also the speed at which the backup runs.
The full archive bit looks for and resets.
My stylist nib is getting really worn down here.
My writing is even worse than normal.
The archive bit, does it look for, does it reset?
Full backup, look for no, reset, yes.
Incremental backup, look for yes, reset yes, reset, yes.
And differential backup, look for yes, reset, no.
Let's put that into the application.
Incremental backup looks for but doesn't reset.
When all the archive bits are reset on Sunday, the backup completes and you run
an incremental on Monday, the files that have changed since they were reset, the
archive bit are flagged identified by the incremental backup and it backs them up.
More or less it backs up since the last full backup, but it also resets.
Now on Tuesday, only the changes from Monday get backed up.
Everything gets reset on Wednesday, on Thursday, etc.
Since you're resetting each time the backup runs, it clears your archive bit
flag and you only back up the files that changed since the last reset.
But again, typically this is in relation to a full backup.
That takes less time to run because you're only back up the files that have changed
that date, more or less, but it's longer to restore.
You have to restore the last full backup
and all the incrementals in order to reach your recovery point.
A differential, on the other hand...
Let's do this in blue just to differentiate.
No pun intended.
To differentiate, a differential doesn't reset.
On Monday, it gets everything from Sunday to Monday, and then it doesn't reset.
On Tuesday, it's everything from Sunday to Tuesday.
It doesn't reset on Wednesday, everything
from Sunday to Wednesday, and you get the idea.
The backup takes longer to run each night because you've got more redundant data,
but the restoration only requires the full backup and the last differential.
You want to consider the speed of the
backup, the speed of the restoration, and the behavior in relation to the archive
bit when you look at the differences between these different types of backups.
There's also copies, one offs and dailies
that really don't do anything with the archive bit.
Copies or a backup doesn't change any states.
Dailies look at timestamps.
One offs, things like that, may not affect the archive bit at all.
That is my standard whiteboard chalk talk for the types of backup.
Full normal, differential, and incremental.
Our data backup tools, things like the File History tool.
File History is a built in backup tool in Windows.
Windows has always had native Windows backup, pretty decent stuff.
You're actually going to be playing around
a bit with your Windows File History tools, your Windows backup.
Data backup retention.
You want to retain your backups as long as it's necessary.
Your backup policy dictates that.
You're going to have dailies, weeklies,
and monthlies, yearlies, and so forth, whatever your policy dictates.
And again, you're going to want to have
onsite restoration copies and off site recovery copies.
Again, your data retention, maintaining important information for meeting
compliance business data archive requirements.
Again, if you don't need to retain it, get rid of it.
Data retention policy is again the formal documentation of that.
Data destruction.
Data destruction process of destroying
data stored on tapes, hard disk, and other forms of electronic media so that it is
completely unreadable, cannot be accessed or used for unauthorized purposes.
In forensics, we're going to talk a lot
more about why deleted data is not deleted and how you recover it.
We want to ensure that the data can't be salvaged or recovered from a discarded
disk drive, file overrides, things like that.
There's various ways to do this.
The main purpose of data destruction is to restrict unauthorized disclosure of
information through proper disposal, destruction of devices, equipment,
computers, and media that stores sensitive data.
Now, it's frightening how much gets thrown
in the garbage without being properly wiped.
Printers and computers, hard drives,
things like that should all go through a standardization process.
Physical destruction is always your best option, but we've got some logical...
Wiping, erasing, de gasing is physical as well.
Couple of different methods for destroying data.
Data destruction policy ensures that the data stored on unused tapes, hard disk,
and other form of electronic media is deleted or destroyed.
With magnetic, a lot of times we can just de gouse it.
Strong magnetic pulse.
Anything that is not magnetic is not subject to de gousing.
You want to use zeroization or physical destruction.
Every organization should implement a data destruction policy.
Mobile phones, typically have a hard reset or cold reset button to delete the
installed software, restore the device to default factory settings.
We also talk about remote wipes with mobile.
That's definitely an option.
Dvds and other tape storage devices physically destroy.
Nothing cooler than throwing a DVD in the
microwave and watching the sparks, watching the light show.
Our tape media were not required.
Hard drives and flash memory devices, you
can use an overwrite function which writes ones and zeros randomly or zeros.
You have multi pass zeroization.
Utilities like the DD command and all
sorts of other data standardization utilities will do hard wipes.
We also talked about the Cypher command,
overriding deleted files on Windows drives.
There's a bunch of Derek's boot and nook, wipe, etc.
Just the dd command.
Dd command on any Linux distro will, if you just specify Dev nulls in the output,
the target device, it'll write zeros to it.
A couple of definitions here.
Now, you may actually see some
contradictions in some definitions of clearing versus purging and destroying.
But when you erase, for example, you
delete a file, you don't really delete the file.
You mark it as deleted.
It's not resident in the file system.
It can still be reclaimed pretty easily.
We'll see some examples of that when you do your forensics labs.
We'll get a little bit later in the course
where we'll get into one of the recovery process.
Clearing, technique to clear all data and user addressable.
Cannot be used for damaged or non writeable media.
Overriding, wiping, and erasure are the methods for that.
Purging, removing data permanently from a
storage device by applying strong magnetic fields.
Magnetic fields can damage nearby devices. Degaussing.
Degaussing is a really strong magnetic
pulse and it also has a tendency to destroy the drive circuitry.
That may not be an option for anything that needs to be reused.
Then destroying, we've got...
These are cool.
Shredders, right?
Shredders with these claws that will just
grind this stuff to bits, or drilling holes in the platter, things like that.
There are shredders in auto salvage arts
for engine blocks, so we definitely have them for hard drives.
Then, of course, you got the YouTube
videos dropping devices in the blender and tearing it up.
I got a cool Vitamix blender here.
I've thought once or twice about seeing
exactly what it can do to physical devices, but I like my blender too much.
Disintegration, Shredding, and Centeration, P ulverizing, and Pulping.
All examples of destroying.
Now, some of this stuff is also referring to paper.
Pulping is reducing it to paper to sludge, removing the ink, that thing.
Data destruction tools, the disk wipe
concept, the Windows disk part utility, command to manage drives, partitions and
volumes, removes data and partitions from a hard drive using the command prompt.
However, when you remove partitions, it's not gone.
You do need to actually perform a write
operation over all the areas of the deleted partition.
Otherwise, it acts like a deleted file.
And again, we will talk more about that in forensics.
Data recovery tools.
Lots of data salvage tools out there.
People delete files all the time that they wish they could have backs.
There's lots of consumer products like Ease US Data Recovery Wizard.
You'll be using Ease US in a lab to cover deleted files.
But if it's been deleted, it's still there unless it's been overwritten.
There's lots of data recovery tools, lots of free tools as well like recover.