Data is lost in many ways: through accidental deletion, hardware defects, faulty updates, theft, fire, or ransomware. A backup only helps if you can actually restore from it. That is why backup and recovery are viewed as a unit: the backup is the means, and successful recovery is the actual goal.
Many companies only discover in an emergency that backups are incomplete, have been failing for weeks, or can only be restored very slowly. A backup concept therefore clarifies not only what is backed up, but also how quickly and in what order data and systems must come back.
How do backup and recovery work?
Backup software copies data to separate storage at defined intervals. Several methods are common:
- Full backup: All selected data is copied. Restoring is simple, but the backup takes a lot of time and storage space.
- Incremental backup: Only the changes since the last backup are copied. This saves space, but a restore requires the chain of backups since the last full backup.
- Differential backup: All changes since the last full backup are backed up.
- Image backup: An entire system, including the operating system and configuration, is captured and can be restored as a whole.
How often backups run and how long a restore may take are defined by RPO and RTO. Where the copies should be stored is described by the 3-2-1 backup rule. Recovery ranges from a single file to restarting entire environments, see Disaster Recovery.
Typical examples
- An overwritten spreadsheet is restored from the previous day's version.
- A defective server is restored from an image backup onto replacement hardware or as a virtual machine.
- After a ransomware attack, systems are rebuilt in a clean environment from backups that the attackers could not alter.
- Mailboxes and files from cloud services such as Microsoft 365 are additionally backed up, because the recycle bin and retention features do not replace an independent backup in every case.
What companies should keep in mind
- Define the backup scope and update it for new systems and cloud services.
- Separate backups from the production network, with their own credentials and at least one copy that is offline or protected against changes as an Immutable Backup.
- Test restores regularly and measure the actual duration.
- Monitor backup jobs and name a person responsible for error messages.
- Encrypt backups and store the keys separately from them.
How it differs
A backup serves to restore data after loss or damage; older versions are overwritten after a defined time. Archiving, by contrast, retains data long-term, immutable and searchable, for example to meet retention obligations. RAID and synchronization are not backups, because they apply deletions and encryptions immediately.
How TOMORIS relates
In TOMORIS connected IT operations, backup and recovery is covered by the GRID.vault module.
View backup and restart with GRID