Image backup & disaster recovery - Backup/Restore

Computer Technology Review, August, 2003 by Morgan Edwards

Almost everyone understands that it is important to back up a computer system. This is a critical practice to ensure the ability to recover from any number of problems, including catastrophic events such as a fire, flood or earthquake.

In day-to-day computer system management, the requirement to restore from a backup media, such as tape, online disk, UNC path, FTR CD-R, optical, etc., will more likely be to restore a strategic file that has become corrupted or accidentally deleted. Less frequently, an entire drive must be restored due to hardware failure or a corrupt operating system partition, which renders the system unbootable.

Normal file-by-file backups usually work well except when the failure occurs on an Intel-based machine's Windows NT/XP/2000/2003 operating system (OS) disk. This is because Intel machines only support one active boot disk. Here are a few common failures that can totally cripple a Windows server or workstation: registry file corruption, installing new device drivers, deleting strategic files and a failed OS hard drive. Any of these problems will make a system unbootable. If your system is unbootable, then a regular file-by-file backup cannot be used until at least a minimal OS has been re-installed; disk partitions are established when required; device drivers are reinstalled; and, if used, any third-party backup software product is re-installed. Only then can a previous file-by-file backup tape be read to recover lost files and/or restore the Registry of the failed machine. For those unfamiliar with Registry files, these are critical system files that contain key information about program groups, security, network connections and other important data that can be very difficult and time consuming to recreate manually, if lost.

A standard file-by-file sys tern disk recovery can take anywhere from two hours to two days, depending on circumstances and the degree of difficulties encountered. Because of file-by-file recovery limitations, alternative methods of backup have been devised that circumvent key file-by-file recovery limitations when attempting to restore an OS partition or disk. While there are a number of names for this alternative method of backup, it is commonly called "Image Backup." Users of Digital Equipment Corporation's old VMS operating system used the term "Stand-alone Backup." Currently in vogue is the phrase "Snap Shot."

Image backup is a process that can completely back up a partition or an entire physical hard drive on a low level, bit-by-bit basis. The image backup process typically does not care what is on the hard drive or even what the hard drive is doing at the time of backup. The backup process simply starts at the first block on the drive and reads every cylinder, track and sector until every bit on the drive has been backed up. The crudest implementation of image backup technology does not see partitions, files or any other arbitrary file system structures--it doesn't know if it's backing up data or empty space. More sophisticated software allows partition-level backup, only active disk cluster back up, software compression, media spanning, and tape or disk output media choices. Even more useful is software that allows (from a recovery perspective) backing up and restoring from network UNC paths, FTP devices, and for large IBM users, Tivoli Storage Manager. Being able to back up and recover from network storage locations enables disaster recovery protection for machines that do not have locally attached tape storage devices.

Performing an image backup is only half the story on how to recover an unbootable machine. The other half is how the disaster recovery part works. Remember, the machine died for some reason and won't boot after any necessary repairs. So, how do you boot the dead machine and "quickly" restore its operating system?

The alter ego to image backup is the ability to quickly reboot a failed system using nothing more than a universal boot CD containing a temporary OS with every device driver, and the image recovery software. The CD boots a "dead" machine, loads all device drivers, connects to the network and initiates the restore of the failed machine's OS partition. With sophisticated software, the recovery can be from local or remote tape, local disk, UNC path, FTP device or from Tivoli. When image technology is combined with network UNC path backups, there is no faster means of recovering a failed machine. With server down time costs ranging from hundreds to thousands of dollars a minute, even speeding up the recovery of a failed machine by a few minutes can pay big dividends. On a fast network, users can expect to restore image backups at speeds from 300-400MB per minute, while users of gigabit networks can see 600-800MB per-minute speeds (second-generation LTO drives also restore at this speed when tape is available).

Part of the beauty of image backup technology is that restores can be scripted so any authorized person can simply insert the boot CD into a dead machine and initiate a "Look Ma, No Hands!" recovery.