Handbook of Information Security Management:Computer Architecture and System Security

Previous Table of Contents Next


Data Vs. Disk

When choosing the files to include in a backup, there is some logic in omitting program files because these already exist on the original program distribution disk(s). However, a fully functioning personal computer is constantly changing. Software is fine-tuned, utility programs are added, batch files and macros created, tool bars and icons are customized, and system files are tweaked for optimum performance. Recreating a system after a major crash involves a lot more than just copying back the data and reinstalling the programs. Numerous parameters, the right combinations of which were previously determined by considerable trial and error, need to be recreated. If you have no backup of configuration or user-preference files, getting the system back to normal can be quite a challenge. A good compromise is to make a complete backup at longer intervals, while backing up changing data files more frequently.

Now consider what you want to include when performing a data file backup. For example, are font files to be included? They seldom change but can take up a lot of space. You might want to omit them from a data file backup. The same applies to spelling dictionaries and thesauri, which do not change. However, user-defined spelling supplements that are regularly updated might need to be included.

The method you use to include or exclude files from a backup operation will depend on the backup software you are using. For example, on the Macintosh, the operating system itself distinguishes between data/document files and program/application files, so backup software on the Mac often has a simple check box to include or exclude programs. Backup software on the PC often has include and exclude parameters based on file extensions. Program files can be excluded by specifying the extensions EXE and COM, plus BAT and SYS (as well as DLL on Windows systems). If you are consistent in your file naming, you might be able to group data files by specifying extensions such as DBF, XLS, DOC, and so on.

Incremental and Differential

An incremental backup involves backing up only those files that have changed since the last backup. The idea is that successive “all data files” backups are likely to include files that were already backed up. This slows down the backup process. Interim backups can be performed that only apply to files that have been added or modified since the last backup. Operating systems can do this by checking the status of files stored along with names and other directory information. Some backup software makes a distinction between incremental and differential backups; the later is defined as all files that are new or modified since the last full backup. This differs from an incremental backup, which is all files that are new or modified since the last backup, either full or incremental.

Note that restoring from an incremental backup, as opposed to a full backup, may require more work. Several sets of media may be required, namely the previous full backup plus all incremental backups since then. On the other hand, restoring from a differential backup requires only the last full backup plus the last differential backup. However, differential backups take up more space and take longer to perform than incrementals. Basically, incrementals are better to systems that are heavily used, like file servers on a network, whereas differentials are more appropriate for single-user systems.

Backup Regimen

The timing of backups depends on how often the information on a system changes. A personal computer might operate purely as an information bank, perhaps used to look up pricing information that seldom changes — such a system only needs to be backed up when the information is updated. But a PC that records customer orders coming in as fast as they can be typed might have to be backed up at least once a day. Most systems are somewhere between these two extremes, but remember that frequency of file changes may not be a constant factor. For example, spreadsheets in the accounting department might change quite often while the annual budget is being prepared, but remain unchanged the rest of the year. So, the backup regimen you implement will depend on how you use your computer. The three factors that need to be weighed against each other are:

  The amount of time and effort represented by changes to files.
  The amount of time and effort represented by backing up the files.
  The value of the contents of the files.

Careful consideration of work patterns is necessary to establish an appropriate backup regimen. You can combine the three levels of backup described earlier, based on three different intervals:

Interval 3  Total backup
Interval 2  Data file backup
Interval 1  Incremental data file backup

For example, you could do a total backup once a month, a total data file backup once a week, and an incremental data file backup every day. The main point is that every backup does not have to be complete or lengthy, and a schedule mixing complete and partial backups will require less time and so stand more chance of being adhered to. One important factor to bear in mind when designing your backup schedule is the ease with which the state of your data at a specific point in the past can be recreated. For example, suppose that a virus is discovered on a hard drive and many files have been infected. A process of deduction determines that the virus was probably introduced on Monday when an employee brought in a game on a floppy disk. If incremental backup is done daily with a full backup on Friday and today is Wednesday, then one option of dealing with the virus is to erase the hard disk and then restore the previous Friday’s backup. Since viruses do not infect true data files you can then restore the data files from the Monday and Tuesday incremental backups.

But what if records were accidentally erased from a data base on Tuesday, and this affected spreadsheets and reports created on Wednesday, yet the error was not discovered until the following Monday? You could not use the complete backup from the immediately preceding Friday to correct this problem. You would need the complete backup from the preceding Friday, plus the following Monday’s incremental backup. If this sort of problem sounds challenging, that’s because it is. Getting people to create backups is only part of the problem. Restoring systems and data from those backups is quite another.


Previous Table of Contents Next




Network Security Library - All you want to know about Windows, UNIX, NetWare, WWW, Firewalls, Intrusion Detection Systems, Security Policy, etc.