1 00:00:00,000 --> 00:00:00,990 In this lesson 2 00:00:00,990 --> 00:00:03,210 you're going to learn how data recovery strategies 3 00:00:03,210 --> 00:00:05,670 can handle and mitigate whatever data loss scenario 4 00:00:05,670 --> 00:00:07,410 is going to be threatening you. 5 00:00:07,410 --> 00:00:08,332 Now, we've previously discussed 6 00:00:08,332 --> 00:00:10,860 how you can implement various security solutions 7 00:00:10,860 --> 00:00:13,530 like encryption, firewalls, and IAM, 8 00:00:13,530 --> 00:00:15,060 and all these solutions contribute 9 00:00:15,060 --> 00:00:16,800 to hardening your Linux system. 10 00:00:16,800 --> 00:00:19,590 However, another major element of cyber security 11 00:00:19,590 --> 00:00:20,850 that you have to learn about 12 00:00:20,850 --> 00:00:23,730 is the backup and restoration process. 13 00:00:23,730 --> 00:00:26,220 Have you ever lost a lot of really important data 14 00:00:26,220 --> 00:00:28,410 or short of that, have you ever felt a moment 15 00:00:28,410 --> 00:00:30,300 of panic when you thought you might have? 16 00:00:30,300 --> 00:00:32,580 Whether they are images of an important life event 17 00:00:32,580 --> 00:00:35,340 like a baby's birth, or a report from work, 18 00:00:35,340 --> 00:00:37,950 or a month's worth of output that you've created, 19 00:00:37,950 --> 00:00:39,540 you probably have this data that you believe 20 00:00:39,540 --> 00:00:41,460 is just too important to lose. 21 00:00:41,460 --> 00:00:43,410 And so you need to back it up. 22 00:00:43,410 --> 00:00:46,950 Now, data can always become corrupted in non-obvious ways, 23 00:00:46,950 --> 00:00:49,740 and this can compromise the integrity of your data as well. 24 00:00:49,740 --> 00:00:52,320 So, you always want to make sure you have a good backup plan 25 00:00:52,320 --> 00:00:53,640 in place because the data 26 00:00:53,640 --> 00:00:56,100 is what is really crucial in our organization. 27 00:00:56,100 --> 00:00:57,780 I could tell you that in my company 28 00:00:57,780 --> 00:00:59,760 our servers are not that important, 29 00:00:59,760 --> 00:01:02,460 because everything we have is backed up in other places. 30 00:01:02,460 --> 00:01:04,860 So, even if I destroyed my server 31 00:01:04,860 --> 00:01:06,390 that's located in my office, 32 00:01:06,390 --> 00:01:08,070 I can immediately restore everything 33 00:01:08,070 --> 00:01:11,190 from backup that are located offsite or in the cloud. 34 00:01:11,190 --> 00:01:12,810 And this is where you want to be as well, 35 00:01:12,810 --> 00:01:15,720 because you want to make sure you have a good backup strategy. 36 00:01:15,720 --> 00:01:18,090 Remember, a backup strategy is not something you create 37 00:01:18,090 --> 00:01:19,170 and put on the shelf, 38 00:01:19,170 --> 00:01:21,480 but it's something you need to implement every single day 39 00:01:21,480 --> 00:01:23,340 as part of your cyber hygiene. 40 00:01:23,340 --> 00:01:24,960 And so, consider this lesson 41 00:01:24,960 --> 00:01:26,940 your guide to backing up, restoring, 42 00:01:26,940 --> 00:01:28,770 and verifying your data. 43 00:01:28,770 --> 00:01:30,630 Now, businesses of all sizes 44 00:01:30,630 --> 00:01:33,827 and across all industries can experience data loss. 45 00:01:33,827 --> 00:01:35,580 Deleted or corrupted files 46 00:01:35,580 --> 00:01:38,160 that result from equipment failures or human error 47 00:01:38,160 --> 00:01:40,200 can lead to a really big problem 48 00:01:40,200 --> 00:01:42,210 and lots of downtime for you. 49 00:01:42,210 --> 00:01:44,730 And this can cause you to miss time critical commitments 50 00:01:44,730 --> 00:01:47,190 or lose out on possible revenue. 51 00:01:47,190 --> 00:01:49,463 Now, a reliable data backup and recovery service 52 00:01:49,463 --> 00:01:51,600 can provide data and system recovery 53 00:01:51,600 --> 00:01:54,960 when your business needs to be back online really quickly. 54 00:01:54,960 --> 00:01:56,557 When you're creating your backup strategy, 55 00:01:56,557 --> 00:01:58,710 you always need to get the business side 56 00:01:58,710 --> 00:02:00,630 of your organization involved with this too, 57 00:02:00,630 --> 00:02:02,171 because you need to identify what data 58 00:02:02,171 --> 00:02:05,400 needs to be protected, not just all data. 59 00:02:05,400 --> 00:02:06,978 And this will help you create a good backup plan 60 00:02:06,978 --> 00:02:10,050 that meets your objectives for your organization. 61 00:02:10,050 --> 00:02:13,560 Your strategy needs to outline what, when, and how 62 00:02:13,560 --> 00:02:16,620 data, applications, and systems are going to be backed up 63 00:02:16,620 --> 00:02:18,420 and restored to a usable state 64 00:02:18,420 --> 00:02:20,550 whenever a catastrophe happens. 65 00:02:20,550 --> 00:02:22,800 Now, a backup is simply a copy of data 66 00:02:22,800 --> 00:02:25,770 that exists in another logical or physical location 67 00:02:25,770 --> 00:02:28,050 other than the original data itself. 68 00:02:28,050 --> 00:02:30,540 Backups are there to facilitate the recovery process 69 00:02:30,540 --> 00:02:33,437 in the case of data loss or equipment failure. 70 00:02:33,437 --> 00:02:35,631 The process of recovering data from a backup 71 00:02:35,631 --> 00:02:37,890 is going to vary depending on the backup types 72 00:02:37,890 --> 00:02:39,120 that you're going to be including 73 00:02:39,120 --> 00:02:41,400 inside of your original backup plans. 74 00:02:41,400 --> 00:02:43,260 Now, there are many different types of backups 75 00:02:43,260 --> 00:02:45,690 and each one serves its own purpose. 76 00:02:45,690 --> 00:02:48,420 A full backup means that all the selected files 77 00:02:48,420 --> 00:02:50,580 are going to be backed up, even though it consumes 78 00:02:50,580 --> 00:02:53,970 a lot more storage space and takes a lot more time. 79 00:02:53,970 --> 00:02:56,037 Now, this type of backup is really good 80 00:02:56,037 --> 00:02:58,770 because it's going to allow you to recover things 81 00:02:58,770 --> 00:03:00,581 very quickly because you have the entire backup 82 00:03:00,581 --> 00:03:02,340 in one place. 83 00:03:02,340 --> 00:03:04,500 Now, incremental and differential backups, 84 00:03:04,500 --> 00:03:07,020 on the other hand, don't back up every single file 85 00:03:07,020 --> 00:03:10,470 on the system, but instead, they only focus on the changes 86 00:03:10,470 --> 00:03:13,620 between those files on the system and the full backup. 87 00:03:13,620 --> 00:03:15,960 Now, the way differential and incremental works 88 00:03:15,960 --> 00:03:17,190 is a little bit different, 89 00:03:17,190 --> 00:03:19,050 so you have to look at each one. 90 00:03:19,050 --> 00:03:21,990 A differential backup means that all the selected files 91 00:03:21,990 --> 00:03:23,970 that have changed since the last full backup 92 00:03:23,970 --> 00:03:25,410 are going to be backed up. 93 00:03:25,410 --> 00:03:27,090 Now, the good thing about this is it requires 94 00:03:27,090 --> 00:03:29,370 less storage space than a full backup, 95 00:03:29,370 --> 00:03:32,130 but the restore time is a little bit less 96 00:03:32,130 --> 00:03:34,410 because you have to restore from a full backup 97 00:03:34,410 --> 00:03:36,690 and then restore the differential. 98 00:03:36,690 --> 00:03:38,520 Now, incremental backups, on the other hand, 99 00:03:38,520 --> 00:03:39,810 take it a step further, 100 00:03:39,810 --> 00:03:42,240 and they only backup files that have changed 101 00:03:42,240 --> 00:03:43,710 since the last backup, 102 00:03:43,710 --> 00:03:46,170 whether that was a full or differential. 103 00:03:46,170 --> 00:03:48,510 So, this takes even less time to perform 104 00:03:48,510 --> 00:03:51,600 than a differential backup, but it includes less data, 105 00:03:51,600 --> 00:03:53,370 and that means it's actually slower 106 00:03:53,370 --> 00:03:54,840 when it comes time to recover 107 00:03:54,840 --> 00:03:56,970 because you need to recover the full backup, 108 00:03:56,970 --> 00:03:58,140 then the differential, 109 00:03:58,140 --> 00:04:01,020 and then the incremental since that differential. 110 00:04:01,020 --> 00:04:02,550 So, there's three restores you need to do 111 00:04:02,550 --> 00:04:05,490 to get back to where you were before the crash. 112 00:04:05,490 --> 00:04:07,740 Now, when we talk about a full differential 113 00:04:07,740 --> 00:04:09,120 or incremental backup, 114 00:04:09,120 --> 00:04:11,209 this is talking about what is actually being backed up 115 00:04:11,209 --> 00:04:12,630 and how much. 116 00:04:12,630 --> 00:04:14,130 Full is going to be the most. 117 00:04:14,130 --> 00:04:16,140 Differential is kind of a medium ground. 118 00:04:16,140 --> 00:04:17,910 And then incremental is the least amount 119 00:04:17,910 --> 00:04:19,829 that's being backed up each time. 120 00:04:19,829 --> 00:04:20,970 Now, in addition to this, 121 00:04:20,970 --> 00:04:23,490 we also have something known as a snapshot. 122 00:04:23,490 --> 00:04:26,280 Now, a snapshot records the state of a storage drive 123 00:04:26,280 --> 00:04:27,840 at a certain point in time. 124 00:04:27,840 --> 00:04:31,050 And usually, these exist on the same drive. 125 00:04:31,050 --> 00:04:33,180 Because of this, if you lose that hard drive 126 00:04:33,180 --> 00:04:34,950 you're also going to lose your snapshot. 127 00:04:34,950 --> 00:04:36,690 And so they don't make a great backup 128 00:04:36,690 --> 00:04:38,610 if you're worried about equipment failure. 129 00:04:38,610 --> 00:04:40,500 But if you're worried about data loss 130 00:04:40,500 --> 00:04:42,870 because somebody made a mistake and deleted a file, 131 00:04:42,870 --> 00:04:45,030 it is a quick way to restore yourself. 132 00:04:45,030 --> 00:04:46,350 Now, another thing you might have 133 00:04:46,350 --> 00:04:48,600 is what's known as an image-based backup. 134 00:04:48,600 --> 00:04:49,980 Now, with an image-based backup, 135 00:04:49,980 --> 00:04:52,080 you're going to save the state of the operating system 136 00:04:52,080 --> 00:04:55,950 into an image file, like an ISO formatted file. 137 00:04:55,950 --> 00:04:58,028 You can then use this image to restore the system 138 00:04:58,028 --> 00:05:01,380 to the state it was in when that image was captured. 139 00:05:01,380 --> 00:05:03,810 Another thing you can do is you can use cloning. 140 00:05:03,810 --> 00:05:06,450 Now, cloning is the process of copying all the contents 141 00:05:06,450 --> 00:05:09,180 of a storage drive to another storage medium. 142 00:05:09,180 --> 00:05:11,490 So, I might have a one terabyte hard drive 143 00:05:11,490 --> 00:05:14,850 on my server and I get a one terabyte external hard drive 144 00:05:14,850 --> 00:05:18,147 and I do a bit by bit clone or copy of the internal disc 145 00:05:18,147 --> 00:05:19,680 to that external disc, 146 00:05:19,680 --> 00:05:21,870 and that serves as my backup. 147 00:05:21,870 --> 00:05:25,096 Now, technically an image backup is a clone of a drive, 148 00:05:25,096 --> 00:05:28,050 and it actually puts it into an ISO file format 149 00:05:28,050 --> 00:05:30,390 instead of taking it up on the entire disc drive, 150 00:05:30,390 --> 00:05:32,400 but it is another way of doing it. 151 00:05:32,400 --> 00:05:35,400 Now, cloning operations can also go one step further though, 152 00:05:35,400 --> 00:05:38,820 by using that image file to reconstruct the original drive 153 00:05:38,820 --> 00:05:41,550 onto a second drive or secondary system. 154 00:05:41,550 --> 00:05:44,640 So it can be very useful when you're trying to restore. 155 00:05:44,640 --> 00:05:47,310 Another thing you should be aware of is tar. 156 00:05:47,310 --> 00:05:49,050 Now, tar is a command that enables you 157 00:05:49,050 --> 00:05:51,120 to create archives of data. 158 00:05:51,120 --> 00:05:53,460 It's very commonly used to create archive files 159 00:05:53,460 --> 00:05:55,200 from a directory that contains data 160 00:05:55,200 --> 00:05:56,400 that you want to back up. 161 00:05:56,400 --> 00:05:59,460 And it can be used to extract files, store additional files, 162 00:05:59,460 --> 00:06:02,610 update files, and list files that were already stored. 163 00:06:02,610 --> 00:06:05,160 The tar command stands for tape archive. 164 00:06:05,160 --> 00:06:07,230 And the tar command can also direct its output 165 00:06:07,230 --> 00:06:08,370 to an available device, 166 00:06:08,370 --> 00:06:11,100 file, or other programs using pipes. 167 00:06:11,100 --> 00:06:13,530 To run the tar command, you're going to type in tar, 168 00:06:13,530 --> 00:06:15,480 the options, and the file name. 169 00:06:15,480 --> 00:06:19,410 For example, if you type in tar -xvf, 170 00:06:19,410 --> 00:06:21,060 this will restore all the contents 171 00:06:21,060 --> 00:06:22,797 of the source file or directory structure 172 00:06:22,797 --> 00:06:26,220 by extracting it back into that directory. 173 00:06:26,220 --> 00:06:28,470 If you want to restore a portion of a tar file, 174 00:06:28,470 --> 00:06:31,590 you can use the path and name of the file you want to extract. 175 00:06:31,590 --> 00:06:34,320 Another command you can use is the disk archiver, 176 00:06:34,320 --> 00:06:37,800 or dar, d-a-r, which is the disc archiver, 177 00:06:37,800 --> 00:06:40,290 is intended to replace tar by offering more backup 178 00:06:40,290 --> 00:06:42,000 and archiving functionality. 179 00:06:42,000 --> 00:06:43,110 And it's especially useful 180 00:06:43,110 --> 00:06:46,620 for creating full, differential, and incremental backups. 181 00:06:46,620 --> 00:06:48,300 Now, if you wanted to use dar, 182 00:06:48,300 --> 00:06:53,300 you could do something like dar -R mydata -c full.bak. 183 00:06:55,350 --> 00:06:56,430 And when you enter that, 184 00:06:56,430 --> 00:06:59,850 you're going to create a full backup of the mydata directory, 185 00:06:59,850 --> 00:07:01,950 and you're going to create this output backup file 186 00:07:01,950 --> 00:07:04,260 called full.bak. 187 00:07:04,260 --> 00:07:06,360 If you want to create a differential backup, 188 00:07:06,360 --> 00:07:09,990 you can do that using the -a option, and it looks this: 189 00:07:09,990 --> 00:07:14,990 dar -R mydata -c diff1.back -A full.bak. 190 00:07:19,650 --> 00:07:21,030 Now, what am I doing here? 191 00:07:21,030 --> 00:07:22,380 Well, I'm going to go ahead 192 00:07:22,380 --> 00:07:24,510 and do a backup in a differential format, 193 00:07:24,510 --> 00:07:28,170 but to do that I have to compare it to my last full backup 194 00:07:28,170 --> 00:07:30,030 so I can see what files have changed. 195 00:07:30,030 --> 00:07:33,660 And that's why we have to have the -A full.bak 196 00:07:33,660 --> 00:07:35,820 to check that backup file. 197 00:07:35,820 --> 00:07:38,400 Another option you can use is -x, 198 00:07:38,400 --> 00:07:40,050 and this stands for extract. 199 00:07:40,050 --> 00:07:41,880 This is used to recover a backup 200 00:07:41,880 --> 00:07:43,723 and place it back on the drive. 201 00:07:43,723 --> 00:07:45,894 Now, if you perform differential backups, 202 00:07:45,894 --> 00:07:47,880 remember, you're going to have to extract 203 00:07:47,880 --> 00:07:51,570 the full backup first, then the latest differential backup. 204 00:07:51,570 --> 00:07:53,220 And then, if you used incremental, 205 00:07:53,220 --> 00:07:55,410 you'll have to do the incremental last. 206 00:07:55,410 --> 00:07:57,510 Another option is -w, 207 00:07:57,510 --> 00:08:00,570 and the -w option is going to overwrite automatically 208 00:08:00,570 --> 00:08:01,939 any changes to files. 209 00:08:01,939 --> 00:08:04,260 Otherwise, if you don't have -w, 210 00:08:04,260 --> 00:08:06,330 it's going to ask you to confirm each time 211 00:08:06,330 --> 00:08:08,580 when you want to overwrite a file. 212 00:08:08,580 --> 00:08:12,180 Another command you should be aware of is cpio. 213 00:08:12,180 --> 00:08:15,150 The cpio command is going to be used to copy files 214 00:08:15,150 --> 00:08:17,040 to and from archives. 215 00:08:17,040 --> 00:08:20,070 The cpio command has three operating modes. 216 00:08:20,070 --> 00:08:23,460 Copy-out, copy-in and copy-pass. 217 00:08:23,460 --> 00:08:26,880 The copy-out mode is used to copy files into an archive, 218 00:08:26,880 --> 00:08:28,500 and it reads from the standard input 219 00:08:28,500 --> 00:08:30,150 to obtain your list of file names 220 00:08:30,150 --> 00:08:33,299 and then copies those files to your standard output. 221 00:08:33,299 --> 00:08:35,970 The copy-in mode is going to be used to copy files 222 00:08:35,970 --> 00:08:37,049 from an archive, 223 00:08:37,049 --> 00:08:39,900 and it's going to extract those files from the standard input, 224 00:08:39,900 --> 00:08:42,570 which means that this option is used in data recovery 225 00:08:42,570 --> 00:08:45,180 and then it's going to place it into your standard output. 226 00:08:45,180 --> 00:08:46,080 Now, on the other hand, 227 00:08:46,080 --> 00:08:48,390 copy-pass is going to be used to copy files 228 00:08:48,390 --> 00:08:50,790 from one directory tree to another. 229 00:08:50,790 --> 00:08:53,160 Basically, it's going to read the standard input 230 00:08:53,160 --> 00:08:55,290 to obtain the list of files that are going to be created 231 00:08:55,290 --> 00:08:58,680 and then copied into this destination directory. 232 00:08:58,680 --> 00:09:02,100 The actual syntax of using the cpio command is going to depend 233 00:09:02,100 --> 00:09:03,690 on the mode you want to use, 234 00:09:03,690 --> 00:09:04,680 but for all modes, 235 00:09:04,680 --> 00:09:06,600 it is going to read from the standard input, 236 00:09:06,600 --> 00:09:08,430 which is normally your keyboard. 237 00:09:08,430 --> 00:09:10,590 Now, for example, let's say I wanted to take 238 00:09:10,590 --> 00:09:15,090 all the contents of a directory and send it over to cpio, 239 00:09:15,090 --> 00:09:16,800 and then archive that to a directory 240 00:09:16,800 --> 00:09:18,780 called directory archive. 241 00:09:18,780 --> 00:09:23,780 To do that, I would type ls | cpio -o > dir_archive, 242 00:09:27,210 --> 00:09:29,430 which is my archive directory. 243 00:09:29,430 --> 00:09:31,740 Now, what this is doing is it's doing the list command 244 00:09:31,740 --> 00:09:35,010 of all the files, piping them into cpio, 245 00:09:35,010 --> 00:09:37,005 and then I'm directing that as an output 246 00:09:37,005 --> 00:09:40,950 to that directory using the greater than re-director. 247 00:09:40,950 --> 00:09:44,490 Now, if I wanted to extract the archive in the copy-in mode, 248 00:09:44,490 --> 00:09:48,847 I can do that by using cpio -i < dir_archive 249 00:09:50,550 --> 00:09:51,810 at the command line. 250 00:09:51,810 --> 00:09:54,660 This will then take everything from the archive directory 251 00:09:54,660 --> 00:09:57,990 and put it back in as part of the copy-in mode. 252 00:09:57,990 --> 00:10:00,090 Next, we have the dd command, 253 00:10:00,090 --> 00:10:03,090 and the dd command is going to copy and convert files 254 00:10:03,090 --> 00:10:04,440 to enable them to be transferred 255 00:10:04,440 --> 00:10:06,870 from one type of media to another. 256 00:10:06,870 --> 00:10:10,170 Now, dd, I like to think about as disk duplicator, 257 00:10:10,170 --> 00:10:12,870 and the dd command has various different operators 258 00:10:12,870 --> 00:10:14,653 or actions that you can perform. 259 00:10:14,653 --> 00:10:17,220 First, you have to specify an input file, 260 00:10:17,220 --> 00:10:20,760 and we call this if= and then the file name. 261 00:10:20,760 --> 00:10:23,820 This specifies where you want data to be read from. 262 00:10:23,820 --> 00:10:25,680 Then we have the output file, 263 00:10:25,680 --> 00:10:28,830 and this is written as of= and the file name. 264 00:10:28,830 --> 00:10:31,020 Now, this is to specify where you want data 265 00:10:31,020 --> 00:10:32,460 to be written to. 266 00:10:32,460 --> 00:10:34,710 Now note, when I'm talking about input files 267 00:10:34,710 --> 00:10:38,760 and output files, this can also mean devices like USB drives 268 00:10:38,760 --> 00:10:41,100 or hard drives, because everything in Linux 269 00:10:41,100 --> 00:10:42,765 is treated as a file. 270 00:10:42,765 --> 00:10:45,240 Then, we have bs=. 271 00:10:45,240 --> 00:10:47,970 Now, bs= is going to be used to specify 272 00:10:47,970 --> 00:10:49,830 the total block size you want to use 273 00:10:49,830 --> 00:10:52,440 when reading or writing in bytes. 274 00:10:52,440 --> 00:10:56,070 So, you might have 1024 bytes, 275 00:10:56,070 --> 00:11:01,070 and you'd write that as bs=1024, which is one megabyte. 276 00:11:01,230 --> 00:11:04,290 Now, conversely, you can also put this in megabytes, 277 00:11:04,290 --> 00:11:07,590 kilobytes, or gigabytes by adding the letters after it. 278 00:11:07,590 --> 00:11:11,190 For instance 1M would be one megabyte, 279 00:11:11,190 --> 00:11:13,680 and that would be allowed under the block size as well. 280 00:11:13,680 --> 00:11:16,080 The next option you have is count=, 281 00:11:16,080 --> 00:11:17,520 and you're going to use this to specify 282 00:11:17,520 --> 00:11:18,870 the number of blocks to be written 283 00:11:18,870 --> 00:11:21,360 to the output file from the input file. 284 00:11:21,360 --> 00:11:23,910 So, if you only want to write the first 100 blocks, 285 00:11:23,910 --> 00:11:26,610 you can do that instead of writing the entire thing. 286 00:11:26,610 --> 00:11:27,840 This is an option in the command 287 00:11:27,840 --> 00:11:29,640 and does not need to be used. 288 00:11:29,640 --> 00:11:31,350 And then we have status. 289 00:11:31,350 --> 00:11:33,810 Now, status= is an operator that we're going to use 290 00:11:33,810 --> 00:11:35,970 to specify the level of information to print 291 00:11:35,970 --> 00:11:37,320 to your standard error. 292 00:11:37,320 --> 00:11:38,153 And this will tell you 293 00:11:38,153 --> 00:11:39,420 what kind of errors do you want to see 294 00:11:39,420 --> 00:11:40,920 as this thing is happening. 295 00:11:40,920 --> 00:11:42,390 Now you could have no errors. 296 00:11:42,390 --> 00:11:43,710 You could have no transfer errors. 297 00:11:43,710 --> 00:11:46,170 You could have progress messages and things like that. 298 00:11:46,170 --> 00:11:47,730 So if you want to see those to the screen, 299 00:11:47,730 --> 00:11:50,760 you can configure how deep of an error message you want 300 00:11:50,760 --> 00:11:52,920 by using the status level here. 301 00:11:52,920 --> 00:11:54,210 To run the dd command, 302 00:11:54,210 --> 00:11:57,510 you're going to type in dd options and the operands. 303 00:11:57,510 --> 00:12:00,450 So for example, let's say I want to do a full backup 304 00:12:00,450 --> 00:12:02,010 of a storage partition. 305 00:12:02,010 --> 00:12:07,010 I can do this by typing dd if=/dev/sda of=/dev/sdb. 306 00:12:10,830 --> 00:12:15,094 And this going to copy all of the data from sda to sdb 307 00:12:15,094 --> 00:12:18,270 Now, in addition to going from one device to another, 308 00:12:18,270 --> 00:12:20,760 you can go from one device to a file. 309 00:12:20,760 --> 00:12:22,350 And to do this, you would use something 310 00:12:22,350 --> 00:12:27,350 like dd if=/dev/sda2 of=/backup/full.dd, 311 00:12:31,500 --> 00:12:35,310 And this would do a sda2 partition 312 00:12:35,310 --> 00:12:38,490 The next command we have is known as mirrorvg. 313 00:12:38,490 --> 00:12:41,580 Now, mirrorvg is a command that copies or mirrors 314 00:12:41,580 --> 00:12:45,540 all the logical volumes in a specified logical volume group. 315 00:12:45,540 --> 00:12:48,000 By default, this command will create the mirrors 316 00:12:48,000 --> 00:12:49,800 on the same drives that are associated 317 00:12:49,800 --> 00:12:51,330 with the volume group. 318 00:12:51,330 --> 00:12:52,350 To use this command, 319 00:12:52,350 --> 00:12:55,140 you're going to type in mirrorvg, the options, 320 00:12:55,140 --> 00:12:56,970 and the volume group name. 321 00:12:56,970 --> 00:13:00,240 So for example, if I wanted to use the -c option, 322 00:13:00,240 --> 00:13:02,370 this could create two or three copies 323 00:13:02,370 --> 00:13:05,760 of a logical volume by saying how many I want. 324 00:13:05,760 --> 00:13:07,770 By default, if you leave no options, 325 00:13:07,770 --> 00:13:10,440 you're going to create one single copy. 326 00:13:10,440 --> 00:13:12,870 Now, in addition to using mirrorvg to mirror 327 00:13:12,870 --> 00:13:17,610 all the volumes in group, you can also use mklvcopy. 328 00:13:17,610 --> 00:13:21,600 Now, mklvcopy is a command that's used to mirror individual 329 00:13:21,600 --> 00:13:24,120 logical volumes in a volume group. 330 00:13:24,120 --> 00:13:25,950 You can also create one or more mirrors 331 00:13:25,950 --> 00:13:29,130 of a logical volume using the lvcreate command 332 00:13:29,130 --> 00:13:32,310 using the -m# option. 333 00:13:32,310 --> 00:13:33,600 Now, for example, let's say 334 00:13:33,600 --> 00:13:38,160 I wanted to create one 10 gigabyte mirror called mirrorlv. 335 00:13:38,160 --> 00:13:41,850 And I want to copy that from the volgr volume group. 336 00:13:41,850 --> 00:13:42,683 To do this 337 00:13:42,683 --> 00:13:47,480 I would type lvcreate -L 10G -m1 -n mirrorlv volgr, 338 00:13:52,140 --> 00:13:56,250 and this says, use the lvcreate or logical volume create 339 00:13:56,250 --> 00:14:01,117 to create a 10 gigabyte mirror of the name mirrorlv 340 00:14:01,117 --> 00:14:05,160 from the volgr volume group. 341 00:14:05,160 --> 00:14:06,330 Now, another important thing 342 00:14:06,330 --> 00:14:08,370 that you have to think about when it comes to backups 343 00:14:08,370 --> 00:14:10,410 is where are you going to place these backups? 344 00:14:10,410 --> 00:14:12,780 Because it's a great thing to have all your backups, 345 00:14:12,780 --> 00:14:15,060 and even if you do it to external devices 346 00:14:15,060 --> 00:14:16,650 like an external hard drive, 347 00:14:16,650 --> 00:14:18,690 if it's still sitting right next to your server 348 00:14:18,690 --> 00:14:21,750 or in your offices, and those offices go up in smoke 349 00:14:21,750 --> 00:14:24,690 due to a fire or a flood or something like that, 350 00:14:24,690 --> 00:14:26,430 you're going to lose all your data. 351 00:14:26,430 --> 00:14:28,290 So instead, you always want to make sure 352 00:14:28,290 --> 00:14:30,330 you have a good offsite backup, 353 00:14:30,330 --> 00:14:32,550 which is essentially just a physical location 354 00:14:32,550 --> 00:14:34,740 outside of your main site that can store 355 00:14:34,740 --> 00:14:36,240 copies of your data. 356 00:14:36,240 --> 00:14:38,730 These offsite backups are a really good component 357 00:14:38,730 --> 00:14:40,860 in your disaster recovery procedures, 358 00:14:40,860 --> 00:14:43,155 and they're often necessary to reconstruct the data 359 00:14:43,155 --> 00:14:46,710 in the event of a major disruption to your main site. 360 00:14:46,710 --> 00:14:49,440 Usually it's very convenient to connect both sites 361 00:14:49,440 --> 00:14:52,320 by a network like a VPN, and then transfer the data 362 00:14:52,320 --> 00:14:55,830 over the network or to use a cloud-based offsite backup 363 00:14:55,830 --> 00:14:57,360 as a way to do this. 364 00:14:57,360 --> 00:14:59,155 For example, in one of my previous jobs, 365 00:14:59,155 --> 00:15:02,880 in the old days we actually took our tape archives 366 00:15:02,880 --> 00:15:05,430 that we made and sent them to another site. 367 00:15:05,430 --> 00:15:07,140 And so once a week, every Friday, 368 00:15:07,140 --> 00:15:09,507 we would take our full backups and all the incrementals 369 00:15:09,507 --> 00:15:12,060 for that week and send them to this alternate location, 370 00:15:12,060 --> 00:15:14,040 which was about an hour's drive away. 371 00:15:14,040 --> 00:15:16,590 And that way, if we had an issue at our main facility, 372 00:15:16,590 --> 00:15:18,840 we knew that that facility still had good tapes 373 00:15:18,840 --> 00:15:20,580 that we could restore from. 374 00:15:20,580 --> 00:15:23,820 Now, when it comes to sending data offsite, like I said, 375 00:15:23,820 --> 00:15:26,220 these days it's so much easier to do this 376 00:15:26,220 --> 00:15:28,890 over a VPN and transferring it over the network 377 00:15:28,890 --> 00:15:30,810 because we have much faster connection speeds 378 00:15:30,810 --> 00:15:32,970 than we did 10 or 15 years ago. 379 00:15:32,970 --> 00:15:34,710 Now, there are a lot of data transfer tools 380 00:15:34,710 --> 00:15:36,510 that are out there that are useful for you 381 00:15:36,510 --> 00:15:39,270 when you're trying to do your offsite backup process. 382 00:15:39,270 --> 00:15:41,550 This includes tools like scp, 383 00:15:41,550 --> 00:15:43,470 which is a tool that's used to copy data to 384 00:15:43,470 --> 00:15:46,140 or from a remote host over SSH, 385 00:15:46,140 --> 00:15:47,970 which uses an encrypted tunnel. 386 00:15:47,970 --> 00:15:49,860 This means all the data that's being sent 387 00:15:49,860 --> 00:15:52,770 is protecting its confidentiality because it's encrypted 388 00:15:52,770 --> 00:15:54,660 as it's moving through the network. 389 00:15:54,660 --> 00:15:57,297 Another tool you can use is SFTP, 390 00:15:57,297 --> 00:16:01,020 and SFTP is the Secure File Transfer Protocol. 391 00:16:01,020 --> 00:16:03,420 And it allows you to use an SSH tunnel 392 00:16:03,420 --> 00:16:06,360 as a transportation mechanism to encrypt that data 393 00:16:06,360 --> 00:16:09,720 and then send the files through the FTP protocol. 394 00:16:09,720 --> 00:16:11,490 Now, when you're using scp, 395 00:16:11,490 --> 00:16:13,470 it's purely for transmitting files, 396 00:16:13,470 --> 00:16:16,035 but SFTP can transfer files 397 00:16:16,035 --> 00:16:18,960 as well as managing files and directories. 398 00:16:18,960 --> 00:16:20,970 So this makes it a little bit more useful 399 00:16:20,970 --> 00:16:23,760 when you're trying to do full system backups. 400 00:16:23,760 --> 00:16:26,698 Another great tool you can use is known as rsync. 401 00:16:26,698 --> 00:16:29,670 Rsync is a tool that's used to copy files locally 402 00:16:29,670 --> 00:16:31,650 and over to remote systems. 403 00:16:31,650 --> 00:16:33,930 The real power here is this efficient use 404 00:16:33,930 --> 00:16:35,220 of network bandwidth. 405 00:16:35,220 --> 00:16:37,170 So instead of copying all the files, 406 00:16:37,170 --> 00:16:39,480 it will only copy differences between files. 407 00:16:39,480 --> 00:16:43,140 So, if you use rsyncs on all the files in a directory, 408 00:16:43,140 --> 00:16:45,450 it's going to check the destination directory first, 409 00:16:45,450 --> 00:16:46,950 see which files already exist, 410 00:16:46,950 --> 00:16:48,870 and then only send over the changes. 411 00:16:48,870 --> 00:16:51,600 In this way, it works very much like a differential backup 412 00:16:51,600 --> 00:16:54,264 versus a full backup, but it allows you to keep two systems 413 00:16:54,264 --> 00:16:56,247 in sync with all of their files. 414 00:16:56,247 --> 00:16:58,615 And it works really well to have a ready standby 415 00:16:58,615 --> 00:17:00,964 for all of your files from your file system 416 00:17:00,964 --> 00:17:03,840 to the secondary server on the other side of the network 417 00:17:03,840 --> 00:17:05,343 by using a tool like rsync.