How are you going to back up your data? (Part 1)

Article Summary

In part 1, I describe the two types of backups. An Image backup is tied to the physical structure of the device you are backing up. A full restore of an image backup must be to a device the same size or bigger and resulting in an exact copy of physical device backed up ignoring any type of file security.

A file-based backup is tied to the directory and file structure of the device you are backing up. You can choose what folders and files to backup and what not to backup. A restore of a file-based backup does not care about the media it is being restored to as long as there is enough space to store the data chosen.  File security is typically key in restores of a file-based backup.

An image backup can typically restore individual files, based on the software package, but a file backup cannot create a bootable image.

____________________________________________________________________________________________________________

In my last post, I started bringing up the topic of backups. Most cybersecurity experts would not talk about backups, because they are so fundamental to disaster recovery that backups are assumed. I have always likened backups to insurance – they are not considered important until something bad happens.  And when something bad happens, there is nothing more important.

Unfortunately, this discussion is going to start out being more technical than I would really like, but the idea here is to get a concept of differences found in backup methods and some of the advantages or disadvantages of them.

Backup Types

Just like insurance, there are a couple of different types of backups and different strategies in performing backups. There are two basic types of backups – image backups and file backups.

Image Backups

An image backup makes copies of an entire storage structure like a disk drive. This backup does not care if there is data on any given area of the disk drive, it copies every area of the disk drive. This is the best type of backup when trying to backup your operating system, boot sectors and all the other system information that is stored on a disk drive.

Restoring from an image backup results in an exact copy of the disk drive from when it was backed up.  That would include not only the data, but also any unused space on the disk drive. This means the device you are restoring to must be as large or larger than the disk you backed up. For example, you could restore a disk that was labeled a 500 GB disk to a 1 TB (1000 GB) disk, but you could not restore an image backup of a 500 GB disk to a 350 GB disk even though you had only 100 GB of data on the original disk.  

But things don’t stay that simple.There is also a possible problem trying to restore a 500 GB from manufacturer A to a 500 GB disk from manufacturer B. Even though the two disks are of the same size class, the actual number of bytes available on manufacturer A’s disk may be more than the number of bytes available on manufacturer’s B disk. In this case, the restoration would fail.

I have also seen differences in the actual number of bytes available on different disk classifications (workstation disk versus server disk versus high-speed server disk) of the same size class from the same manufacturer.  So, the best rule of thumb when doing an image backup restore is to make sure what you are restoring to is exactly the same model of disk or it is larger than what you are restoring from.

The big advantage of an image backup is that you theoretically could plug a restored image backup in replacement of a failed device and pickup from when the backup was made. If you are restoring a device that contains the operating system for the machine you are using, there may be some extra steps that your backup package might require for the restoration of the backup to work properly.  

Some backup packages will actually allow you to restore a backup from one computer to a completely different computer. The restoration process would actually change the operating system to work with the different devices that may be on the computer you are restoring to that were not in the computer you are restoring from. However, experience has shown that this typically doesn’t work if you are restoring from one manufacturer’s CPU to a different manufacturer’s CPU. For example, restoring a backup from a computer using an Intel processor typically doesn’t work if you do the restoration to a computer that uses an AMD processor.

Many image backup packages will allow you to treat an image backup as a separate device and a machine by running a specific program. You could then copy a specific file from this backup like you would copy a file from one device to another.

File Backups

The second type of backup is a file-based backup. This type of backup copies just the data you tell it to backup. When you restore from this type of backup, you tell the backup package where you want your data to be restored. The restoration could be placed in the same location that it was when the backup was made or in another location on either the same physical device that contains the original data or another device entirely.

When you restore from a file-based backup, you only need enough space on your restoration target to hold the data you are restoring.  

The problem with a file-based backup is that you may have problems restoring an installed program or database, and you will definitely not be able to restore an operating system or create a bootable image.