English:Data Backup and Recovery
Data Backup and Recovery
Introduction
Data backup and recovery are practical skills that protect an organization when files are deleted, hardware fails, software corrupts data, a site is damaged, or ransomware makes systems unavailable. In this aiMOOC, you learn how to choose backup methods, protect backup copies, define recovery objectives, verify data integrity, and perform controlled restores. The course is designed for apprentices, trainees, and vocational students who work with computers, networks, servers, business applications, or digital production systems.
A backup is useful only when it can support a successful recovery. For that reason, you will treat backup and recovery as one process: identify important data, create protected copies, monitor the jobs, test restores, document the procedure, and improve the plan after each test or incident.
Workplace focus: Imagine that a small company loses its shared project folder at 10:15 on a busy Monday. Your task is not simply to say, "We have a backup." You need to know which copy is safe, how much recent work may be lost, how long recovery may take, who is allowed to restore the data, and how you will prove that the recovered files are complete and usable.
Why Backup and Recovery Matter
Organizations depend on data for orders, designs, customer records, accounts, production plans, source code, machine configurations, and communication. Data loss can interrupt work, cause financial loss, create legal or contractual problems, and damage trust. Common causes include accidental deletion, device failure, faulty updates, software defects, theft, fire, flooding, malware, and unauthorized changes.
The image above shows why a copy stored beside the original system may not be enough. A local disaster can affect both the production system and nearby backup media. A sound strategy therefore considers physical separation as well as technical redundancy.
The U.S. National Institute of Standards and Technology describes contingency planning as a coordinated set of plans, procedures, and technical measures for recovering systems, operations, and data after disruption. For workplace practice, this means that recovery needs documented responsibilities, priorities, procedures, and testing rather than improvised actions during an emergency. NIST contingency planning guidance
Backup, Synchronization, Replication, and Archiving
These terms are related but not interchangeable.
| Concept | Main purpose | Important limitation |
|---|---|---|
| Backup | Keep recoverable copies of data from selected points in time. | A backup that is never monitored or restored may fail when it is needed. |
| Synchronization | Keep files aligned between locations or devices. | Deletion or corruption may also synchronize, so synchronization alone is not a complete backup strategy. |
| Replication | Maintain another current copy of data or a service, often for availability. | Replication can copy unwanted changes quickly and may not preserve older versions. |
| Archiving | Preserve information for long-term retention, reference, or compliance. | Archived data is not automatically designed for rapid operational recovery. |
A mature environment may use all four techniques, but you should know which problem each one is intended to solve.
The 3-2-1 Backup Principle
A widely used baseline is the 3-2-1 principle: keep at least three copies of important data, use at least two different storage types or systems, and keep at least one copy off-site or otherwise isolated from the production environment. Modern guidance often strengthens this idea with an offline, isolated, or immutable copy that attackers cannot easily change.
For example, a workshop might keep production files on a server, a local backup on a separate backup appliance, and another protected copy at a different location or in a properly secured cloud backup service. The exact design depends on risk, cost, recovery targets, data volume, and legal requirements.
The CISA ransomware guide recommends offline, encrypted backups of critical data and regular tests of backup availability and integrity. It also warns that ransomware can try to delete or encrypt accessible backups. CISA StopRansomware Guide
After viewing the CISA material, identify which parts of your current or imagined workplace backup design would still be reachable if an administrator account were compromised.
Backup Methods
Different backup methods trade storage use, backup duration, and restore complexity against one another.
| Method | What is copied | Typical advantage | Typical recovery consideration |
|---|---|---|---|
| Full backup | All selected data. | Simple recovery baseline and easy to understand. | Requires more time and storage for each backup. |
| Incremental backup | Data changed since the most recent backup in the chain. | Usually reduces backup time and storage use. | A restore may depend on the last full backup plus multiple incremental backups. |
| Differential backup | Data changed since the last full backup. | Recovery can use the last full backup plus the latest differential backup. | Differential backups usually grow until the next full backup. |
| System image | A broader image of a system, often including operating system, applications, settings, and data. | Can speed rebuilding of a failed workstation or server. | Hardware, drivers, licensing, and current security updates still need attention. |
| Snapshot | A recorded state of a storage system or volume at a point in time. | Supports fast rollback or copy creation in many platforms. | A snapshot stored on the same failed or compromised system may disappear with that system, so it is not automatically an independent backup. |
A backup schedule might combine methods. For example, a system can use periodic full backups with more frequent incrementals. You should design the schedule around recovery requirements rather than around convenience alone.
Application Consistency
A file can be copied successfully and still be unusable if an application was writing to it at the same time. Databases, virtual machines, and business applications may need application-aware backup methods, quiescing, transaction logs, or coordinated snapshots so that related data is captured consistently.
When you evaluate a backup product or procedure, ask whether the result is merely a crash-consistent copy or whether the application itself can be restored to a valid state. The best answer depends on the software and workload.
Storage Media and Backup Destinations
Backup copies can be stored on disks, solid-state storage, network-attached storage, tape, removable media, dedicated appliances, cloud object storage, or managed backup services. No medium is perfect. You should consider capacity, speed, durability, physical security, lifecycle, compatibility, access control, cost, and recovery time.
Hard disk drives remain common for local backup because they offer large capacities and relatively fast restores. However, a drive permanently attached to a compromised machine can be exposed to the same malware or administrative mistakes as the production data.
Tape can provide high-capacity, removable storage and physical separation. In professional environments, tape libraries can automate large backup sets. Tape workflows also require careful labeling, rotation, retention control, secure storage, compatible drives, and periodic restore testing.
Cloud backup can improve geographic separation and automation, but it still needs security design. Protect backup accounts with strong authentication, least privilege, separate administrative controls, appropriate retention, and—where supported—immutability or deletion protection. A cloud copy that an attacker can erase with stolen production credentials is not sufficiently isolated.
RAID, Redundancy, and the Backup Boundary
RAID can improve availability when a disk fails, but RAID is not a substitute for backup. If a user deletes a file, malware encrypts a folder, an application corrupts data, or the whole server is destroyed, RAID may preserve or reproduce the unwanted state rather than provide an older clean copy.
RAID 1 mirrors data across drives. That redundancy can keep a system operating after a drive failure, but the same deletion or corruption is normally mirrored too. Treat RAID as an availability or storage-resilience technique and backup as a recovery technique.
When watching the RAID explanation, focus on what happens when a physical drive fails. Then compare that failure mode with accidental deletion or ransomware and explain why the recovery requirements differ.
Recovery Objectives: RPO and RTO
Two important planning terms connect business needs with technical design.
Recovery Point Objective (RPO) describes the maximum acceptable amount of data loss measured in time. If an order system has an RPO of 30 minutes, the organization should design protection so that, after a disruption, it does not normally need to return to data older than that target.
Recovery Time Objective (RTO) describes the maximum acceptable delay between a disruption and restoration of the service. If a file service has an RTO of four hours, the recovery process, resources, and staffing should be designed to restore acceptable service within that period.
| Workplace service | Example RPO | Example RTO | Design implication |
|---|---|---|---|
| Training file share | One workday | One workday | A daily protected backup may be sufficient if the business accepts the possible loss. |
| Order database | Thirty minutes | Two hours | More frequent recovery points and a faster restore path are needed. |
| Machine-control configuration repository | Four hours | One hour | Recovery may prioritize rapid access to validated configuration files over large historical archives. |
These values are only examples. Real RPO and RTO targets must be set by the organization after considering business impact, cost, risk, contractual duties, and technical limits. AWS and IBM both describe RPO as the acceptable age of the last recovery point and RTO as the acceptable delay before service restoration. AWS recovery objectives IBM backup and restore overview
Use the video to distinguish backup from the broader process of disaster recovery. A backup provides recoverable data; disaster recovery also includes people, procedures, infrastructure, dependencies, communication, and service restoration.
Protecting Backup Data
Backups often contain the same sensitive information as production systems, so they need equivalent or stronger protection.
| Control | Why it matters |
|---|---|
| Least privilege | Limits who can read, create, delete, or change backup data and policies. |
| Separate administrative accounts | Reduces the chance that one compromised production account can also destroy backups. |
| Multi-factor authentication | Adds protection to management actions when supported. |
| Encryption in transit and at rest | Protects backup content from unauthorized disclosure during transfer and storage. |
| Offline or isolated copies | Reduces exposure to ransomware and destructive administrator actions. |
| Immutability or write protection | Prevents protected recovery points from being changed or deleted before their retention period expires. |
| Retention rules | Define how long recovery points are kept and help meet operational, legal, or contractual needs. |
| Audit logs and alerts | Help detect failed jobs, unusual deletion attempts, or unauthorized changes. |
Encryption keys and credentials must themselves be recoverable and securely managed. An encrypted backup is useless if the organization loses the only key required to decrypt it.
Integrity and Verification
A backup job that reports "success" should not be treated as final proof of recoverability. Verification can include checking job logs, validating file counts or application status, comparing hashes or checksums where appropriate, scanning for corruption, and performing actual restores.
A checksum or cryptographic hash can help detect whether data has changed unexpectedly. Verification does not replace a restore test, because a restore also tests permissions, media readability, software compatibility, procedures, credentials, and the ability to return the application or file to useful service.
Restore Testing
Restore testing is one of the most important parts of a backup program. You should test representative files and, when appropriate, complete systems or applications in a safe environment. A good test confirms more than whether bytes can be copied back.
A restore test should answer questions such as: Can you locate the correct recovery point? Are the credentials available? Is the backup catalog readable? Are encryption keys accessible? Is the restored application consistent? Are permissions correct? Does the recovered service meet the target RTO? Is the amount of data loss within the target RPO? Can users validate the result?
Document the test date, selected recovery point, system or files restored, elapsed recovery time, problems encountered, corrective actions, and responsible person. This turns a technical exercise into evidence that the recovery plan is maintained.
A Safe Recovery Workflow
During an incident, speed matters, but uncontrolled action can make evidence disappear or reintroduce malware. Follow the organization’s incident-response and authorization procedures.
| Phase | Practical action |
|---|---|
| Assess | Confirm what failed, which systems and data are affected, and whether the cause may still be active. |
| Contain | Isolate affected systems when required and protect clean backup copies from further damage. |
| Select | Choose a known-good recovery point that meets business needs and is believed to be free of the incident. |
| Rebuild or prepare | Create a trusted target environment, patch systems, and confirm required applications, drivers, keys, and dependencies. |
| Restore | Recover data or systems using the approved procedure and record what was done. |
| Validate | Check integrity, permissions, application consistency, security controls, and user acceptance. |
| Return to service | Reconnect or reopen the system in a controlled way and monitor it closely. |
| Review | Compare the outcome with RPO and RTO targets, capture lessons, and improve the plan. |
Never practice destructive restore steps on production data unless the organization has explicitly authorized the procedure and the risk is controlled. Training should use a lab, disposable virtual machine, test folder, or other safe environment.
Documentation and Operational Routine
A reliable backup process is repeatable. Your documentation should identify what is protected, where copies are stored, which schedule and retention rules apply, who receives alerts, how failed jobs are handled, where restore instructions are kept, and how often tests are performed.
A professional routine also includes capacity checks, media lifecycle management, software updates, access reviews, log review, recovery drills, and removal of obsolete backups according to policy. Documentation itself should be protected and available during an outage, including when the normal network or identity service is unavailable.
Vocational Scenario: The Deleted Project Folder
You are supporting a design workshop. At 10:15, a trainee reports that a shared project folder has disappeared. The file server is still running, and other folders are accessible.
A disciplined response begins by protecting the current state and confirming whether the event is accidental deletion, a permissions problem, synchronization error, malware, or another incident. You check the approved recovery procedure and determine the latest clean recovery point. Before restoring, you confirm the destination and permissions so that you do not overwrite newer work or expose confidential files. After the restore, a responsible user validates the recovered project and you record the recovery point, elapsed time, and any missing changes.
This scenario shows why backup is not only a storage task. It combines troubleshooting, authorization, communication, security, documentation, and service management.
Professional Guidance and Further Reading
The following sources are suitable starting points for workplace-oriented backup and recovery practice:
- Contingency planning: NIST SP 800-34 Rev. 1 explains contingency planning, recovery strategies, procedures, testing, and maintenance.
- Ransomware defense: CISA StopRansomware Guide emphasizes protected backups, offline copies, and regular restoration tests.
- Backup strategy: Microsoft guidance for backup and ransomware resilience explains 3-2-1 design, isolated copies, and recovery objectives.
- Recovery objectives: AWS Well-Architected recovery objectives explains how RPO and RTO guide recovery design.
Interactive Tasks
Quiz: Test Your Knowledge
What is the main purpose of a backup? (To provide a recoverable copy of data) (!To make every disk run faster) (!To replace all access controls) (!To eliminate the need for testing)
What does the 3-2-1 backup principle require as a baseline? (Three copies on two storage types with one off-site or isolated) (!Three passwords on two accounts with one shared) (!Three servers in two rooms with one administrator) (!Three folders on one disk with one hidden)
What does RPO describe? (The maximum acceptable data loss measured in time) (!The maximum acceptable restore password length) (!The minimum number of backup operators) (!The physical size of a backup device)
What does RTO describe? (The maximum acceptable delay before service restoration) (!The number of files in a recovery point) (!The time required to create an encryption key) (!The age of a storage device)
What does an incremental backup normally copy? (Data changed since the most recent backup) (!All selected data every time) (!Only operating system files) (!Only data changed since the last full backup)
What does a differential backup normally copy? (Data changed since the last full backup) (!Only files changed since the latest incremental backup) (!Every file on every storage device) (!Only deleted files)
Why is RAID 1 not a complete backup solution? (Deletion or corruption can be mirrored to both drives) (!RAID 1 cannot use more than one drive) (!RAID 1 always stores data off-site) (!RAID 1 prevents all hardware failures)
What provides the strongest evidence that a backup can actually be used? (A successful controlled restore test) (!A green power light on the storage device) (!A large amount of free disk space) (!A printed list of filenames)
Why keep an offline or immutable backup copy? (To reduce the chance that ransomware can alter or delete it) (!To make the production network faster) (!To remove the need for encryption) (!To avoid documenting retention rules)
What can a checksum help you detect? (Unexpected changes in data) (!The physical location of a user) (!The business cost of downtime) (!The number of administrators on duty)
Memory Game
| Backup | Independent copy kept so data can be recovered |
| Restore | Process of returning saved data to a usable state |
| RPO | Maximum acceptable amount of recent data loss measured in time |
| RTO | Maximum acceptable delay before a service is restored |
| Full backup | Copy of all selected data |
| Incremental backup | Copy of changes since the most recent backup |
| Differential backup | Copy of changes since the last full backup |
| Checksum | Value used to help detect unexpected data changes |
Drag and Drop
| Match the correct terms. | Topic |
|---|---|
| Full backup | Copies all selected data |
| Incremental backup | Copies changes since the latest backup |
| Differential backup | Copies changes since the latest full backup |
| Offline copy | Is kept unavailable to ordinary production access |
| Restore test | Demonstrates whether saved data can be recovered |
...
Crossword Puzzle
| Backup | What is a recoverable copy of data called? |
| Restore | What process returns saved data to a usable state? |
| Checksum | What value can help reveal an unexpected data change? |
| Ransomware | What malware commonly encrypts data and may target reachable backups? |
| Retention | What word describes how long backup recovery points are kept? |
| Snapshot | What word means a recorded storage state at a particular point in time? |
LearningApps
Cloze Text
Open-Ended Tasks
Easy
- Backup Inventory: Create a one-page inventory of five types of workplace data and decide which items would need backup first; explain your choices in clear English.
- Storage Media Comparison: Photograph or draw three backup media or destinations and add short captions comparing capacity, portability, security, and likely restore speed.
- Recovery Checklist: Write a simple checklist for restoring one accidentally deleted training file without overwriting newer work.
- Restore Demonstration: In a safe test folder, create sample files, make a copy, delete one file, restore it, and record the steps with screenshots.
Standard
- 3-2-1 Backup Plan: Design a 3-2-1 backup plan for a small workshop or office, including storage locations, schedule, retention, access rights, and one isolated copy.
- File Restore Lab: Use an approved lab tool or test virtual machine to perform a backup and restore, then measure the elapsed recovery time and document any errors.
- User Interview: Interview a trainer, technician, or system user about which data is most important to their work and turn the answers into proposed RPO and RTO targets.
- Backup Tutorial Video: Produce a three-minute instructional video that explains the difference between full, incremental, and differential backups using your own workplace example.
Advanced
- RPO and RTO Design: Analyze three services in a fictional company, propose different RPO and RTO targets for each, and justify how the targets influence backup frequency and recovery technology.
- Ransomware Recovery Drill: Plan and conduct a tabletop exercise in which production files and reachable backups are assumed to be encrypted; identify containment, clean recovery, validation, and communication steps.
- Integrity Verification Project: Create a safe lab experiment that compares file checksums before and after a controlled change, then explain what checksum verification can and cannot prove about recoverability.
- Disaster Recovery Portfolio: Build a complete recovery portfolio for a small business system containing a data inventory, risk analysis, backup design, restore procedure, test record, lessons learned, and a short presentation.
Learning Assessment
- Recovery Strategy Analysis: Given a company with one local file server and one permanently attached backup disk, identify at least three failure scenarios and redesign the protection so that each scenario has a realistic recovery path.
- Backup Method Decision: Compare full, incremental, and differential backup methods for a 2 TB project share that changes by 100 GB per day, then recommend a schedule based on storage use, backup time, and restore complexity.
- RPO RTO Transfer: A sales system can lose no more than 15 minutes of data and must return within one hour; explain how these requirements affect backup frequency, infrastructure, staffing, and testing.
- Ransomware Resilience Review: Evaluate a backup design in which the same domain administrator can delete production data and all cloud recovery points, then propose controls that reduce this shared risk.
- Restore Evidence Review: Examine a fictional backup report that shows all jobs as successful but contains no restore-test records; explain why the evidence is incomplete and design a meaningful test.
- Business Communication: Write a concise incident update for a supervisor after a restore in which service is back within the RTO but 20 minutes of data are missing against a 10-minute RPO, including the technical fact, business impact, and next action.
Evidence of Learning
| Evidence type | What successful learning can show |
|---|---|
| Knowledge | You can distinguish backup, synchronization, replication, archiving, full backups, incremental backups, differential backups, snapshots, RAID, RPO, RTO, retention, integrity verification, and restore testing. |
| Skills | You can choose a suitable recovery point, follow an authorized restore procedure, verify results, interpret job logs, document recovery time, and communicate problems clearly. |
| Products | You can produce a backup inventory, 3-2-1 design, recovery checklist, restore-test record, RPO and RTO proposal, and disaster recovery portfolio. |
| Security practice | You can explain why isolated copies, least privilege, separate administration, encryption, immutability, and protected credentials improve recovery resilience. |
| Transfer | You can adapt backup and recovery decisions to a new workplace scenario by considering business impact, threats, data volume, cost, legal requirements, and acceptable downtime. |
OERs on the Topic
Open educational and professional resources can help you extend the course. Use the English Wikipedia article above for background concepts, then compare its explanations with current guidance from NIST and CISA before applying procedures in a workplace.
This server image is a reminder that large digital services depend on physical infrastructure. Backups and recovery plans must account for failures of hardware, sites, networks, software, identities, and human procedures.
Linked Learning Areas
aiMOOC Projects
MOOCwiki · Deutsch
Nach dem Lernen ist vor dem Lernen
Entdecke direkt den nächsten Lernkurs. Weitere Inhalte erscheinen, wenn Du weiter nach unten scrollst.
Zur MOOCwiki-HauptseiteMediathek
Mediathek
Mediathek wird aus dem Wiki geladen ...
Keine passenden Inhalte gefunden. Bitte ändere Suche oder Filter.