Restoring Data

This chapter describes the process of backing up a network. Backup is only half the story, though; in order to do any good, a backup must allow you to restore data. There are two types of restore that you must consider:

• Partial restores ” In a partial restore, you need to restore just a few noncritical files. For instance, a user might need a file that was deleted last week, or you might need to recover an old set of log files. Such a process is usually a fairly simple reversal of the process used to create the backup. For instance, rather than use the --create option to tar , you use --extract and specify the filename or directory you want to restore. As noted earlier, if you use a mounted filesystem and server-initiated backup, you must ensure that the backup client's network server is configured for read-write access from the backup server, which isn't a requirement for backups alone.

• Full restores ” The nightmare scenario for any backup procedure is a full restore, in which you must recover all the files on a disk, or at least all those required to boot the computer. Such a situation can occur because a hard disk failed or because of some software disaster, such as a computer that's been accidentally wiped out by an errant command like rm -r / .

WARNING

One reason for doing a full restore is to recover a system to a state prior to its invasion by a cracker. You must be very cautious when doing such restores to both wipe out all the files the invader left behind and to use a backup that predates the system's compromise. Following such a restore, you must fix whatever problems existed that allowed the computer to be cracked.

Full restores are difficult to handle because you must find some way to get the restore onto a computer that has no working software. One common approach to solving this problem is to prepare an emergency restore system on a floppy disk, bootable CD-ROM, bootable Zip disk, or the like. For network backup clients, this disk should include network configuration tools and whatever network backup clients or servers you used to create the backup in the first place.

TIP

Even if your network consists of a Linux backup server and a large number of Windows 9 x /Me backup clients, you can use a Linux-based emergency restore system. Such a system can include Samba, and you can use it to run an SMB/CIFS server to which the Linux backup server can restore files. After performing a full restore, you may need to use DOS's FDISK to mark the boot partition as bootable, and use the SYS program from the version of Windows you've backed up to write a boot sector to the boot partition. If you have Windows NT, 2000, or XP backup clients, the process may be more complex, particularly if they use NTFS. In such a case, installing the systems initially with a small boot partition you can back up and restore with Linux's dd or a commercial tool like DriveImage can greatly simplify restoration.

Sometimes, you may want to use a different method for a full restore than you used for a backup. For instance, a client-initiated Samba backup using a backup share might be more easily restored by using either a client-initiated direct tar restore via rshd or a server-initiated restore using either NFS or Samba.

In some cases, and especially if you haven't adequately planned an emergency restore procedure, you may have to reinstall the base OS in order to restore normal backup client functionality. You can then use this configuration to restore the rest of the data to the system, as if it were a partial restore.

AMANDA is unusual among the tools described here in that it includes client-based restore tools. The most powerful of these is amrecover , which in turn calls other tools such as amrestore . When you type amrecover as root on the backup client to enter the recovery utility, the program presents you with its own prompt at which you can type commands like setdate (to set the date of a backup from which you want to recover), cd (to change into a directory in the backup), add (to add a file to a restore set), and extract (to restore files from a restore set). After you type extract , amrecover prompts you for the appropriate tapes to restore data.

No matter what methods you use for restoration, it's critical that you test them before they become necessary. Ideally, you should set up a test system and try backing it up and performing both partial and full restores on that test system. If your network hosts several different OSs, repeat these tests with each of the OSs. Fully document your restoration procedures, and periodically retest them, particularly if your network changes in any important way. Keep backups of your emergency restore disks ”you don't want to be surprised by a bad floppy, which Murphy's Law guarantees you'd discover at exactly the wrong time.