In this lesson
you're going to learn how data recovery strategies
can handle and mitigate whatever data loss scenario
is going to be threatening you.
Now, we've previously discussed
how you can implement various security solutions
like encryption, firewalls, and IAM,
and all these solutions contribute
to hardening your Linux system.
However, another major element of cyber security
that you have to learn about
is the backup and restoration process.
Have you ever lost a lot of really important data
or short of that, have you ever felt a moment
of panic when you thought you might have?
Whether they are images of an important life event
like a baby's birth, or a report from work,
or a month's worth of output that you've created,
you probably have this data that you believe
is just too important to lose.
And so you need to back it up.
Now, data can always become corrupted in non-obvious ways,
and this can compromise the integrity of your data as well.
So, you always want to make sure you have a good backup plan
in place because the data
is what is really crucial in our organization.
I could tell you that in my company
our servers are not that important,
because everything we have is backed up in other places.
So, even if I destroyed my server
that's located in my office,
I can immediately restore everything
from backup that are located offsite or in the cloud.
And this is where you want to be as well,
because you want to make sure you have a good backup strategy.
Remember, a backup strategy is not something you create
and put on the shelf,
but it's something you need to implement every single day
as part of your cyber hygiene.
And so, consider this lesson
your guide to backing up, restoring,
and verifying your data.
Now, businesses of all sizes
and across all industries can experience data loss.
Deleted or corrupted files
that result from equipment failures or human error
can lead to a really big problem
and lots of downtime for you.
And this can cause you to miss time critical commitments
or lose out on possible revenue.
Now, a reliable data backup and recovery service
can provide data and system recovery
when your business needs to be back online really quickly.
When you're creating your backup strategy,
you always need to get the business side
of your organization involved with this too,
because you need to identify what data
needs to be protected, not just all data.
And this will help you create a good backup plan
that meets your objectives for your organization.
Your strategy needs to outline what, when, and how
data, applications, and systems are going to be backed up
and restored to a usable state
whenever a catastrophe happens.
Now, a backup is simply a copy of data
that exists in another logical or physical location
other than the original data itself.
Backups are there to facilitate the recovery process
in the case of data loss or equipment failure.
The process of recovering data from a backup
is going to vary depending on the backup types
that you're going to be including
inside of your original backup plans.
Now, there are many different types of backups
and each one serves its own purpose.
A full backup means that all the selected files
are going to be backed up, even though it consumes
a lot more storage space and takes a lot more time.
Now, this type of backup is really good
because it's going to allow you to recover things
very quickly because you have the entire backup
in one place.
Now, incremental and differential backups,
on the other hand, don't back up every single file
on the system, but instead, they only focus on the changes
between those files on the system and the full backup.
Now, the way differential and incremental works
is a little bit different,
so you have to look at each one.
A differential backup means that all the selected files
that have changed since the last full backup
are going to be backed up.
Now, the good thing about this is it requires
less storage space than a full backup,
but the restore time is a little bit less
because you have to restore from a full backup
and then restore the differential.
Now, incremental backups, on the other hand,
take it a step further,
and they only backup files that have changed
since the last backup,
whether that was a full or differential.
So, this takes even less time to perform
than a differential backup, but it includes less data,
and that means it's actually slower
when it comes time to recover
because you need to recover the full backup,
then the differential,
and then the incremental since that differential.
So, there's three restores you need to do
to get back to where you were before the crash.
Now, when we talk about a full differential
or incremental backup,
this is talking about what is actually being backed up
and how much.
Full is going to be the most.
Differential is kind of a medium ground.
And then incremental is the least amount
that's being backed up each time.
Now, in addition to this,
we also have something known as a snapshot.
Now, a snapshot records the state of a storage drive
at a certain point in time.
And usually, these exist on the same drive.
Because of this, if you lose that hard drive
you're also going to lose your snapshot.
And so they don't make a great backup
if you're worried about equipment failure.
But if you're worried about data loss
because somebody made a mistake and deleted a file,
it is a quick way to restore yourself.
Now, another thing you might have
is what's known as an image-based backup.
Now, with an image-based backup,
you're going to save the state of the operating system
into an image file, like an ISO formatted file.
You can then use this image to restore the system
to the state it was in when that image was captured.
Another thing you can do is you can use cloning.
Now, cloning is the process of copying all the contents
of a storage drive to another storage medium.
So, I might have a one terabyte hard drive
on my server and I get a one terabyte external hard drive
and I do a bit by bit clone or copy of the internal disc
to that external disc,
and that serves as my backup.
Now, technically an image backup is a clone of a drive,
and it actually puts it into an ISO file format
instead of taking it up on the entire disc drive,
but it is another way of doing it.
Now, cloning operations can also go one step further though,
by using that image file to reconstruct the original drive
onto a second drive or secondary system.
So it can be very useful when you're trying to restore.
Another thing you should be aware of is tar.
Now, tar is a command that enables you
to create archives of data.
It's very commonly used to create archive files
from a directory that contains data
that you want to back up.
And it can be used to extract files, store additional files,
update files, and list files that were already stored.
The tar command stands for tape archive.
And the tar command can also direct its output
to an available device,
file, or other programs using pipes.
To run the tar command, you're going to type in tar,
the options, and the file name.
For example, if you type in tar -xvf,
this will restore all the contents
of the source file or directory structure
by extracting it back into that directory.
If you want to restore a portion of a tar file,
you can use the path and name of the file you want to extract.
Another command you can use is the disk archiver,
or dar, d-a-r, which is the disc archiver,
is intended to replace tar by offering more backup
and archiving functionality.
And it's especially useful
for creating full, differential, and incremental backups.
Now, if you wanted to use dar,
you could do something like dar -R mydata -c full.bak.
And when you enter that,
you're going to create a full backup of the mydata directory,
and you're going to create this output backup file
called full.bak.
If you want to create a differential backup,
you can do that using the -a option, and it looks this:
dar -R mydata -c diff1.back -A full.bak.
Now, what am I doing here?
Well, I'm going to go ahead
and do a backup in a differential format,
but to do that I have to compare it to my last full backup
so I can see what files have changed.
And that's why we have to have the -A full.bak
to check that backup file.
Another option you can use is -x,
and this stands for extract.
This is used to recover a backup
and place it back on the drive.
Now, if you perform differential backups,
remember, you're going to have to extract
the full backup first, then the latest differential backup.
And then, if you used incremental,
you'll have to do the incremental last.
Another option is -w,
and the -w option is going to overwrite automatically
any changes to files.
Otherwise, if you don't have -w,
it's going to ask you to confirm each time
when you want to overwrite a file.
Another command you should be aware of is cpio.
The cpio command is going to be used to copy files
to and from archives.
The cpio command has three operating modes.
Copy-out, copy-in and copy-pass.
The copy-out mode is used to copy files into an archive,
and it reads from the standard input
to obtain your list of file names
and then copies those files to your standard output.
The copy-in mode is going to be used to copy files
from an archive,
and it's going to extract those files from the standard input,
which means that this option is used in data recovery
and then it's going to place it into your standard output.
Now, on the other hand,
copy-pass is going to be used to copy files
from one directory tree to another.
Basically, it's going to read the standard input
to obtain the list of files that are going to be created
and then copied into this destination directory.
The actual syntax of using the cpio command is going to depend
on the mode you want to use,
but for all modes,
it is going to read from the standard input,
which is normally your keyboard.
Now, for example, let's say I wanted to take
all the contents of a directory and send it over to cpio,
and then archive that to a directory
called directory archive.
To do that, I would type ls | cpio -o > dir_archive,
which is my archive directory.
Now, what this is doing is it's doing the list command
of all the files, piping them into cpio,
and then I'm directing that as an output
to that directory using the greater than re-director.
Now, if I wanted to extract the archive in the copy-in mode,
I can do that by using cpio -i < dir_archive
at the command line.
This will then take everything from the archive directory
and put it back in as part of the copy-in mode.
Next, we have the dd command,
and the dd command is going to copy and convert files
to enable them to be transferred
from one type of media to another.
Now, dd, I like to think about as disk duplicator,
and the dd command has various different operators
or actions that you can perform.
First, you have to specify an input file,
and we call this if= and then the file name.
This specifies where you want data to be read from.
Then we have the output file,
and this is written as of= and the file name.
Now, this is to specify where you want data
to be written to.
Now note, when I'm talking about input files
and output files, this can also mean devices like USB drives
or hard drives, because everything in Linux
is treated as a file.
Then, we have bs=.
Now, bs= is going to be used to specify
the total block size you want to use
when reading or writing in bytes.
So, you might have 1024 bytes,
and you'd write that as bs=1024, which is one megabyte.
Now, conversely, you can also put this in megabytes,
kilobytes, or gigabytes by adding the letters after it.
For instance 1M would be one megabyte,
and that would be allowed under the block size as well.
The next option you have is count=,
and you're going to use this to specify
the number of blocks to be written
to the output file from the input file.
So, if you only want to write the first 100 blocks,
you can do that instead of writing the entire thing.
This is an option in the command
and does not need to be used.
And then we have status.
Now, status= is an operator that we're going to use
to specify the level of information to print
to your standard error.
And this will tell you
what kind of errors do you want to see
as this thing is happening.
Now you could have no errors.
You could have no transfer errors.
You could have progress messages and things like that.
So if you want to see those to the screen,
you can configure how deep of an error message you want
by using the status level here.
To run the dd command,
you're going to type in dd options and the operands.
So for example, let's say I want to do a full backup
of a storage partition.
I can do this by typing dd if=/dev/sda of=/dev/sdb.
And this going to copy all of the data from sda to sdb
Now, in addition to going from one device to another,
you can go from one device to a file.
And to do this, you would use something
like dd if=/dev/sda2 of=/backup/full.dd,
And this would do a sda2 partition
The next command we have is known as mirrorvg.
Now, mirrorvg is a command that copies or mirrors
all the logical volumes in a specified logical volume group.
By default, this command will create the mirrors
on the same drives that are associated
with the volume group.
To use this command,
you're going to type in mirrorvg, the options,
and the volume group name.
So for example, if I wanted to use the -c option,
this could create two or three copies
of a logical volume by saying how many I want.
By default, if you leave no options,
you're going to create one single copy.
Now, in addition to using mirrorvg to mirror
all the volumes in group, you can also use mklvcopy.
Now, mklvcopy is a command that's used to mirror individual
logical volumes in a volume group.
You can also create one or more mirrors
of a logical volume using the lvcreate command
using the -m# option.
Now, for example, let's say
I wanted to create one 10 gigabyte mirror called mirrorlv.
And I want to copy that from the volgr volume group.
To do this
I would type lvcreate -L 10G -m1 -n mirrorlv volgr,
and this says, use the lvcreate or logical volume create
to create a 10 gigabyte mirror of the name mirrorlv
from the volgr volume group.
Now, another important thing
that you have to think about when it comes to backups
is where are you going to place these backups?
Because it's a great thing to have all your backups,
and even if you do it to external devices
like an external hard drive,
if it's still sitting right next to your server
or in your offices, and those offices go up in smoke
due to a fire or a flood or something like that,
you're going to lose all your data.
So instead, you always want to make sure
you have a good offsite backup,
which is essentially just a physical location
outside of your main site that can store
copies of your data.
These offsite backups are a really good component
in your disaster recovery procedures,
and they're often necessary to reconstruct the data
in the event of a major disruption to your main site.
Usually it's very convenient to connect both sites
by a network like a VPN, and then transfer the data
over the network or to use a cloud-based offsite backup
as a way to do this.
For example, in one of my previous jobs,
in the old days we actually took our tape archives
that we made and sent them to another site.
And so once a week, every Friday,
we would take our full backups and all the incrementals
for that week and send them to this alternate location,
which was about an hour's drive away.
And that way, if we had an issue at our main facility,
we knew that that facility still had good tapes
that we could restore from.
Now, when it comes to sending data offsite, like I said,
these days it's so much easier to do this
over a VPN and transferring it over the network
because we have much faster connection speeds
than we did 10 or 15 years ago.
Now, there are a lot of data transfer tools
that are out there that are useful for you
when you're trying to do your offsite backup process.
This includes tools like scp,
which is a tool that's used to copy data to
or from a remote host over SSH,
which uses an encrypted tunnel.
This means all the data that's being sent
is protecting its confidentiality because it's encrypted
as it's moving through the network.
Another tool you can use is SFTP,
and SFTP is the Secure File Transfer Protocol.
And it allows you to use an SSH tunnel
as a transportation mechanism to encrypt that data
and then send the files through the FTP protocol.
Now, when you're using scp,
it's purely for transmitting files,
but SFTP can transfer files
as well as managing files and directories.
So this makes it a little bit more useful
when you're trying to do full system backups.
Another great tool you can use is known as rsync.
Rsync is a tool that's used to copy files locally
and over to remote systems.
The real power here is this efficient use
of network bandwidth.
So instead of copying all the files,
it will only copy differences between files.
So, if you use rsyncs on all the files in a directory,
it's going to check the destination directory first,
see which files already exist,
and then only send over the changes.
In this way, it works very much like a differential backup
versus a full backup, but it allows you to keep two systems
in sync with all of their files.
And it works really well to have a ready standby
for all of your files from your file system
to the secondary server on the other side of the network
by using a tool like rsync.