Data Recovery Service, Information Security and Information Forensic Articles.

Archive for the ‘Data Backup’ Category

Protect Your Data Before IT Gone

Friday, April 2nd, 2010

Which is more expensive? A computer or data inside it? In my opinion, the most expensive is the data. If the computer is damaged, we can still buy a new computer. If the data of our work gone, which was years effort we made has been lost, what can make it back again? it can possibly get back, but not as easy and as cheap to buy a new computer. And also not necessarily the data will return intact.

That’s not to underestimate the data storage medium of our work. Be helpful to have another planning before data we actually damaged or lost. The first thing we must recognize are what are the cause of damage or loss of data, namely:
1. Virus attack
2. System (OS) Crash
3. Hard disk Crash / damaged
4. Accidentally deleted

1. Virus attack

For the first cause is a virus attack, the file can be lost or damaged. File2 is nothing to return or not depends on a virus that attacked ferociously. There are viruses that only our file2 hide or change the file extension into other files. For this, we can find again. But there are malignant virus that can delete files in your computer permanently. Well, for this one, we can cry for a week :-)

2. System (OS) Crash

The second cause of the OS crashes. If we are using windows and had crashes, the first way is to make recovery from the windows CD. But if the recovery fails, then the other way is to reformat the hard drive and install a new OS. What about our data? Surely, if the format helped drive lost data would be formatted.

3. Hard disk Crash / damaged

The third cause lost of data is Hard disk crash. This cause by hardware problems, especially electronics. We can not guarantee an electronic device can run forever. When the disk has started out suspicious sound, that’s when the hard disk should be retired. We truly hard drive crash / corrupted, the data in it will go away automatically. Indeed there is a way to take back the data stored. Just stay to take special shop repair disk. They specialize in saving data, but does not guarantee the data also will be back in full and of course the price could be very expensive.

4. Accidentally deleted

The fourth is the cause of human error. Data accidentally erased. If only erased recycle bin and go, you live restore again. But if removed permanently, it seems difficult to go back. Similarly, the second cause, there are some techniques to get the data back but not necessarily with high paying cost of recovery.

For that we need to prepare themselves well before all this happened. You would not want his work over the years lost in an instant. For example for writers whose work has a lot of sediment on the hard disk contemplation of lost years caused by a virus. To that required some effective preventive measures, namely:

1. Make a different disk partition for the System (OS) and the data.

Suppose you have a 80GB hard drive, make it two partitions for Windows (usually drive C, 30GB) and for data (usually Drive D, 50GB). The virus usually will attack the system. So when the system crashes due to virus attack, we can easily do a full format and installation of new systems. Data stored on another partition will not have to formatted. Causes damage to the first and second could be handled well. Even My Document also can we move it to D. I will explain in the next post. Just wait yes …

2. Get used to backup data regularly to another storage medium.

For archives and important data, it helps us also make backups to CD / DVD or to another storage such as external hard drive. So when something happens to our computers, important data will not be lost because it was stored in a safe place.

3. Be careful and note that the data will be removed when doing disk cleanup.

Let us not regret it later because the deleted data is data that is still needed.

4. Complete computer protection from virus attacks, Trojans, Spyware and others.

Moreover, if the Internet connected computer. This can be done by using software-software that can be downloaded for free on the Internet, for example AVG, Spybot, etc..

Better to prevent than cure. If the behavior in using our computers correctly, guaranteed you will not regret in the future because of loss of important data. Good luck.

How to Maintaining Resource Availability in a Information System

Saturday, December 5th, 2009

RAID

RAID stands for redundant array of inexpensive disks or redundant array of independent disks. Its primary purpose is to provide fault tolerance and protection against file server hard disk failure and the resultant loss of availability and data. Some RAID types secondarily improve system performance by caching and distributing disk reads from multiple disks that work together to save files simultaneously.

 

Simply put, RAID separates the data into multiple units and stores it on multiple disks by using a process called striping. It can be implemented as either a hardware or a software solution; each type of implementation has its own issues and benefits.

The RAID Advisory Board has defined three classifications of RAID:

·         Failure-Resistant Disk Systems (FRDS)

 

·         Failure-Tolerant Disk Systems

 

·         Disaster-Tolerant Disk Systems

 

RAID Levels

RAID is implemented in one or a combination of several ways, called levels. They are:

 

  • RAID Level 0 creates one large disk by using several disks. This process is called striping. It stripes data across all disks (but provides no redundancy) by using all the available drive space to create the maximum usable data volume size and to increase the read/write performance. One problem with this level of RAID is that it actually lessens the fault tolerance of the disk system rather than increasing it; the entire data volume is unusable if one drive in the set fails.
  • RAID Level 1 is commonly called mirroring. It mirrors the data from one disk or set of disks by duplicating the data onto another disk or set of disks. This process is often implemented by a one-for-one disk-to-disk ratio; each drive is mirrored to an equal drive partner that is continually being updated with current data. If one drive fails, the system automatically gets the data from the other drive. The main issue with this level of RAID is that the one-for-one ratio is very expensive, resulting in the highest cost per megabyte of data capacity. This level effectively doubles the amount of hard drives you need; therefore, it is usually best for smaller-capacity systems.
  • RAID Level 2 consists of bit-interleaved data on multiple disks. The parity information is created by using a Hamming code, which detects errors and establishes which part of which drive is in error. It defines a disk drive system with 39 disks – 32 disks of user storage and seven disks of error-recovery coding. This level is not used in practice and was quickly superseded by the more flexible levels of RAID that follow.
  • RAID Levels 3 and 4 are discussed together because they function in the same way. The only difference is that Level 3 is implemented at the byte level, whereas Level 4 is usually implemented at the block level. In this scenario, data is striped across several drives, and the parity check bit is written to a dedicated parity drive. This process is similar to RAID 0. They both have a large data volume, but the addition of a dedicated parity drive provides redundancy. If a hard disk fails, the data can be reconstructed by using the bit information on the parity drive. The main issue with these levels of RAID is that the constant writes to the parity drive can create a performance hit. In this implementation, spare drives can be used to replace crashed drives.
  • RAID Level 5 stripes the data and the parity information at the block level across all the drives in the set. It is similar to RAID 3 and 4 except that the parity information is written to the next-available drive rather than to a dedicated drive by using an interleave parity. This feature enables more flexibility in the implementation and increases fault tolerance because the parity drive is not a single point of failure, as it is in RAID 3 and 4. The disk reads and writes are also performed concurrently, thereby increasing performance over levels 3 and 4. The spare drives that replace the failed drives are usually hot swappable, meaning they can be replaced on the server while the system is up and running. This is probably the most popular implementation of RAID today.

Vendors created various other implementations of RAID to combine the features of several RAID levels, although these levels are less common. Level 6 is an extension of Level 5 that allows for additional fault tolerance by using a second independent distributed-parity scheme (i.e., two-dimensional parity). Level 10 is created by combining Level 0 (striping) with Level 1 (mirroring). Level 15 is created by combining Level 1 (mirroring) with Level 5 (interleave). Level 51 is created by mirroring entire Level 5 arrays. Table below shows the various levels of RAID with terms you will need to remember.

Table: RAID Level Descriptions
Open table as spreadsheet

RAID LEVEL   DESCRIPTION  
Striping 
Mirroring 
Hamming Code Parity 
Byte Level Parity 
Block Level Parity 
Interleave Parity 
Second Independent Parity 
Single Virtual Disk 
10  Striping Across Multiple Pairs (1+0) 
15  Striping With Parity Across RAID 5 Pairs (1+5) 
51  Mirrored RAID 5 Arrays With Parity (5+1) 

Backup Concepts

A CISSP candidate will also need to know the basic concepts of data backup. The candidate might be presented with questions regarding file selection methods, tape format types, and common problems.

 

Tape Backup Methods

The purpose of a tape backup method is to protect and restore lost, corrupted, or deleted information – thereby preserving the data’s integrity and ensuring network availability. There are several varying methods of selecting files for backup.

 

Most backup methods use the Archive file attribute to determine whether the file should be backed up. The backup software determines which files need to be backed up by checking to see whether the Archive file attribute has been set and then resets the Archive bit value to null after the backup procedure.

The three most common methods are:

1.      Full Backup Method - This backup method makes a complete backup of every file on the server every time it is run. A full or complete backup backs up all files in all directories stored on the server regardless of when the last backup was made and whether the files have already been backed up. The Archive file attribute is changed to mark that the files have been backed up, and the tapes or tapes will have all data and applications on it or them. The method is primarily run for system archive or baselined tape sets.

 

2.      Incremental Backup Method – The incremental backup method backs up files that have been created or modified only since the last backup was made, or in other words files whose Archive file attribute is reset. This can result in the backup operator needing several tapes to do a complete restoration, because every tape with changed files as well as the last full backup tape will need to be restored.

 

3.       Differential Backup Method – The differential backup method backs up files that have been created or modified only since the last backup was made, like an incremental backup. The difference between an incremental backup and a differential backup is that the Archive file attribute is not reset after the differential backup is completed. Therefore the changed file is backed up every time the differential backup is run. The backup set grows in size until the next full backup, as these files continue to be backed up during each subsequent differential backup. The advantage of this backup method is that the backup operator should need only the full backup and the latest differential backup to restore the system.

 

Other Backup Formats

  • Compact Disc (CD) Optical Media. Write once, read many (WORM) optical disk “jukeboxes” are used for archiving data that does not change. This is a very good format to use for a permanent backup. Companies use this format to store data in an accessible format that may need to be accessed at a much later date, such as legal data. The shelf life of a CD is also longer than a tape. Rewritable and erasable (CDR/W) optical disks are sometimes used for backups that require short-time storage for changeable data but require faster file access than tape. This format is used more often for very small data sets.
  • Zip/Jaz Drives, SyQuest, and Bernoulli Boxes. These types of drives are frequently used for the individual backups of small data sets of specific application data. These formats are very transportable and are often the standard for data exchange in many businesses.
  • Tape Arrays. A tape array is a large hardware/software system that uses the RAID technology we discussed earlier in a large device with multiple (sometimes 32 or 64) tapes, configured as a single array. These devices require very specific hardware and software to operate, but they provide a very fast backup and a multitasking backup of multiple targets with considerable fault tolerance.
  • Hierarchical Storage Management (HSM). HSM provides a continuous online backup by using optical or tape “jukeboxes,” similar to WORMs. It appears as an infinite disk to the system and can be configured to provide the closest version of an available real-time backup. This is commonly employed in very large data retrieval systems.

Common Backup Issues and Problems

All backup systems share common issues and problems, whether they use a tape or a CD-ROM format. There are three primary backup concerns:

 

  • Slow data transfer of the backup. All backups take time, especially tape backup. Depending upon the volume of data that needs to be copied, full backups to tape can take an incredible amount of time. In addition, the time required to restore the data must also be factored into any disaster recovery plan. Backups that pass data through the network infrastructure must be scheduled during periods of low network utilization, which are commonly overnight, over the weekend, or during holidays. This also requires off-hour monitoring of the backup process.
  • ·         Server disk space utilization expands over time. As the amount of data that needs to be copied increases, the length of time to run the backup proportionally increases, and the demand on the system grows as more tapes are required. Sometimes the data volume on the hard drives expands very quickly, thus overwhelming the backup process. Therefore, this process must be monitored regularly.
  • The time the last backup was run is never the time of the server crash. With noncontinuous backup systems, data that was entered after the last backup prior to a system crash will have to be recreated. Some systems have been designed to provide online fault tolerance during backup (the old Vortex Retrochron was one), yet, because backup is a postprocessing batch process, some data reentry will need to be performed.

How to Save Data When Your Hard Disk is Dying

Tuesday, November 10th, 2009

What if you’re in a situation where you feel a drive failure could happen at any moment, but you simply don’t have a means of backing up the drive? I saw this recently with a system that had become too unstable to get through something as disk intensive as a backup; the system died each time someone tried to record files to a CD-R.

In a situation where you have a small number of files you desperately need to save off the hard drive, copy them to a floppy disk or a Zip disk. If you have access to a file compression utility like WinZip or FreeZip, archive up to 1MB of files and send them to yourself in an e-mail; don’t retrieve that e-mail until you come out on the other end of your drive problem. Most web-based e-mail sites allow for file attachments.

If the PC with the failing drive is on a network, move as many important files to a drive on another system where you have access (the drive or folders on the other PC gives you share-level access to save files to them).

Online Backup Services

Online backup services provide you with an account and special software or a browser-based interface for uploading files to their storage servers for an annual fee. The goal of these services isn’t to upload the entire contents of your hard drive but to store strategic files that you can’t afford to lose or that you want stored in a second location accessible through the Internet. Many business travelers subscribe to such services so that if something happens to their laptop while they’re on a trip, they can always log onto the backup service from a borrowed PC or laptop from virtually anywhere and grab the files they need. The following sites provide online backup storage:

@Backup (www.@backup.com) You download and install their software, which provides an easy-to-use interface for uploading files to their storage servers. Pricing here starts at an annual service fee of $49.95 for 50MB or $995 for 2GB. At the time this book was being prepared for release, @Backup was offering a 30-day free trial with annual signup.

Virtual Backup (www.virtualbackup.com) Virtual Backup offers a Simple Plan that allows you to store up to 50MB of files at an annual rate of $39.95 or 100MB for $79.95 a year. Like @Backup, they offer a 30-day free trial.

A Quick E-mail Trick

Here’s a quick trick I learned when I was rushing to secure a really important document for work on a drive that sounded like it would grind itself to death at any moment.

If your word processor or other application has a Send To feature on the File menu (Microsoft Word is one program that has it) and you currently have access to the Internet, send a copy of the file to yourself through e-mail directly from the application.

Let’s pretend I’m furiously trying to finish this chapter on a PC where the drive appears to be having problems. Naturally, I don’t want to take the chance of losing the work, so I would take these steps:

  1. Save the most recent version of the file. If that’s not possible, proceed to step 2.
  2. In Word, I choose File Ø Send to Ø Mail Recipient (you can also choose Mail Recipient as Attachment, if preferred).
  3. When my e-mail software opens, I address the file to myself and click Send. (If you used the Mail Recipient as Attachment option in step 2, you’ll have to specify the name and location of the file you want to send.)
  4. Later, once the hard drive crisis is corrected or from another PC, I retrieve my e-mail and my attached file.

Once your important data is saved in a retrievable format, it’s time to start checking the source of the hard drive problem.

Tags: ,

The Best Practices to Avoid Files Lost or Corrupt

Monday, November 9th, 2009


The best practices you can employ to try to keep the situation from happening in the first place:

Back up! I know I’ve said it so often, but considering how few people actually do it, it bears repeating. Just backing up your daily files off your main hard drive can save you from much aggravation and inconvenience.

Read the documentation. Always read through the documentation either hard copy or online through a Help index for an application to see what recovery methods may be supported before you get into a bad situation.

Go solo. When you’re working on something critical, avoid having any more applications open than you absolutely need. The fewer applications that are open if a problem occurs in Windows, the better your chances that data can be written to the disk without (too much) distortion. Unless you absolutely need to be connected to the Internet while you work. Problems from simple glitches to malicious behavior on the part of others using the Internet can make a crash while connected more likely.

Enable auto-save. Check to see if the programs you use have an automatic save feature like Microsoft Office does. Then be sure to configure it to save your work every 5–10 minutes.

Stabilize your applications and operating system. If you’re having problems with an application you’re working in or with Windows itself, exit your work or avoid reopening it until you resolve the instability.

Avoid saving the only copy of a file on a system or a drive you already know is experiencing problems. If it’s your only system and your only hard drive, save a copy of the file to a floppy or a Zip drive, or if it’s very large, save it onto a CD.

Don’t make major changes in the middle of a project or session. All too often, you hear a tragic story about someone who was rushing to meet a deadline of some kind (writing a big paper, drafting an article, creating a wonderful piece of original art) who takes a break from that project to install a new application or make major changes to his or her machine. My favorite story involves a writer (thankfully, not me) who decided to take an hour’s break from a career-altering deadline to install an operating system beta test. Multiple disasters later, he was three weeks late and lost an important job (he didn’t like to back up either).

Protect your PC from unexpected power losses. Add an uninterruptible power supply (UPS) to your system to prevent situations where you lose power without the ability to properly save your work. Depending on the UPS capacity you get, you might even have time to make an extra copy of your work.

Scan for viruses. While viruses and Trojan horses used to target only executable files (those with the .exe or .com file extensions), many viruses today wreak havoc with more file types, including macros and VBA programming.

When receiving files from others, always scan these files before you open them or save them to a disk.

Watch how you delete. If you like to use the Command Console in Windows XP (or a DOS window for earlier versions of Windows), beware of deleting from the command prompt. Files deleted this way will not appear in the Recycle Bin and are much tougher to resurrect later if you find you’ve erased the wrong files.

Tags: ,

Common Problem That Cause File Corrupt

Monday, November 9th, 2009


Let’s look at the major causes of the disappearance and corruption of files.

Computer Viruses

Your primary concern with computer viruses is that some of them may corrupt the core files that run a particular application, which may affect how the application behaves (or if it opens at all) and may damage files you create using that application.

Sadly, today’s virus-ware now includes programs that attack other types of file formats besides those that actually execute your programs (*.exe and *.com files). For example, Word macro viruses are special viruses written to exploit the Visual Basic programming that can be added to Word and other applications to perform specific functions. Word macro viruses are abundant in corporate settings where users indiscriminately pass the infection back and forth between each other unchecked. Some of these viruses automatically send copies of themselves to contacts stored in an e-mail program’s address book, which is even worse than those bad fruitcakes that re-circulate at holiday time.

Improper Shutdown

The effects of improper shutdown can be devastating on some types of files that may be open on your desktop, including documents you’re working on at the time. These files may not be written properly to disk, may not reflect changes you made since the last time you saved the file, and could become corrupted. Always be sure you shut down your system properly whenever possible.

Even if you never shut down your system improperly, power outages can turn your PC off prematurely. If you have files open at the time of an outage, they might be corrupted when you reopen them after the system reboots.

Operating System Instability

An unstable operating system creates a ripe environment for file corruption because it can cause you to crash out of an application in which you’re working or it can freeze the system in mid-session, requiring you to reboot your PC without saving your open work. Take extra precautions to protect the files you’re working on by saving your files frequently during a session, by saving extra copies of your files, or by performing more frequent backups. Avoid installing any new applications or upgrading existing applications until the operating system is stable.

Problem Applications and Utilities

Another potential cause of file damage can be linked to unstable programs you run on your system. These can be applications that seem to generate corrupted files, applications that conflict with the operation of other programs, or applications that affect your system and the way it stores files or maintains file integrity.

You may see file damage when

  • installing older software
  • installing or using utilities written for an earlier version of Windows (more likely if the utility was written to work with systems running FAT16 file systems, such as pre-Windows 98 systems)
Tip Always check for Windows version compatibility before you buy and/or install software, just as you do with hardware. There are just enough differences between some versions of Windows and the file systems they use to cause serious data issues in some applications.

Formatting and Recovery Tools

For all intents and purposes, formatting your disk wipes it clean of data. But this isn’t entirely true. Expensive professional software packages and data recovery specialists can often look beneath a reformatted disk to extract files and information that you can no longer see. Often, however, these services get priced out of the realm of mere mortals, even if you can claim the cost as a legitimate, tax-deductible business expense.

The same is often true with the recovery disks that many manufacturers distribute with a new PC. Many of those disks work by replacing the current contents of your hard drive with a drive image of what your system looked like when it was configured at the factory, in terms of the operating system and installed applications. When you’re desperate and you use the recovery disk, you may not notice the fine print on the screen warning that you’re about to lose everything you’ve installed since you first turned on the system. And, sadly, a few recovery disks I’ve seen did not even warn you at all; those users didn’t know the implications of using the recovery disk and got a nasty surprise.

Along with recovery disks, you can lose all your current files if you don’t save them off your hard drive before you run a “go back to a previous PC time” program. Such programs allow you to revert your system to the way it was before harmful changes may have been made. System Restore does not typically replace the files you create in your programs; it focuses instead on critical system files. However, some utilities that work similar to System Restore may, so check their documentation. Utilities such as GoBack allow you to preserve the files you’ve created or stored since the last time you made a system snapshot.

Likewise, you can have the same problem restoring a drive image. Always back up your good files before you use any of these techniques so that you don’t lose valuable data.

Other Contributing Factors

Several other problems can contribute to lost or damaged files, such as

  • Power-related problems
  • Dirt and debris in the system
  • Programs running in the background at the time a file is being written to disk, such as virus scanners or anti-crash software (the latter is software which says it protects your system from unwanted crashes)
  • Having your disk (usually removable) in close proximity to serious magnetic exposure, as you might see when putting floppy drives on a stereo unit
  • Using disk utilities while also trying to save open files

Tags: ,