Backup Operations

No matter what type of tape or tape alternative you choose for server backups, you need to understand how backup and restoration processes work and what can go wrong during either process. Typically, backup processes involve making a full backup, followed by one of various backup types that record only changes to files. For the greatest reliability, you should verify a backup upon completion. It's important to keep in mind that a backup must be restored before the files it contains can be used, although in most cases you have the option of restoring all files in a backup or ones that you select.

A successful backup involves the following steps:

1.	Choosing a backup solution that supports your operating system and backup hardware.
2.	Installing or configuring options for open file backup, client backup, and other options to maximize the ability to recover from data loss.
3.	Selecting a full backup as the first backup operation you perform on the server. Make a backup copy, if needed, in case of disaster.
4.	Verifying the backup.
5.	Safely storing your disaster recovery backup for future use.
6.	Performing differential or incremental backups on a regular basis. Differential backups are recommended because a smaller amount of media must be restored to recover from a system crash.
7.	Rotating and replacing tape or removable-media cartridges to enable permanent storage of the most valuable data and prevent media failure and consequent data loss.

8.	Cleaning the tape drive when recommended by the vendor.
9.	Testing the ability to restore the backup. Ideally, you should attempt to restore a disaster recovery backup to a duplicate server. However, at the very least, you should attempt to restore selected files to another folder on your hard disk.

The following sections provide additional details regarding the backup process.

Backup Strategies

The term backup strategy refers to the decisions you make about subjects such as the following:

What files to back up
What method to use to back them up
How often files should be backed up
What to do about open files

The following sections discuss backup strategies, helping you to choose the best backup strategies for your network.

Full Backups and Disaster Recovery Backups

A full backup records all information on the server's hard disk, including data files, applications, operating system files, and the system registry or other configuration details (often referred to as the system state). A full backup should be performed as soon as a server is first configured into operating condition. With Windows 2003 Server, the option in Windows NT Server backup option All Information on This Computer sets up a full backup.

When a full backup is performed, many backup programs provide the option to create a disaster recovery backup. A disaster recovery backup usually involves the creation of one or more bootable floppy disks or a bootable CD. The bootable media is used to start the restoration process without the need to reinstall an operating system first.

Windows 2003 Server's integrated NT Backup utility includes a form of disaster recovery known as the Automated System Recovery (ASR) Wizard. ASR can be used to restore a working system from local storage. ASR makes a floppy disk that is used to guide the restoration process in conjunction with the original Windows 2003 Server CD. Note that ASR restores only system files needed to restart the system. Application and data files must be restored separately, unless you specified the Back Up All Information On My Computer option when you ran the ASR backup.

When a file or folder is first created, its archive bit (one of several file/folder attributes) is turned on. After a full backup, the archive bit is cleared (turned off). Understanding the role of the archive bit is essential to understanding the differences between other types of backups.

Differential Backups

It is not necessary to create a full backup every time you back up your system. Instead, you should back up only changed files. One method offered by most backup programs is a differential backup. A differential backup backs up all files that have changed since the last full backup was performed. Files that are newly created or have been changed turn on the archive bit, but a differential backup, unlike a full backup, does not clear the archive bit.

On a server that experiences many newly created or changed files, differential backups can take almost as much time as full backups. However, unlike incremental backups (discussed in the next section), only the last differential backup needs to be restored after a full backup is restored to restore a system to its latest backed-up configuration.

For example, assume that a server required 4 tapes for its initial full backup. The first differential backup might require only one tape, but because archive bits aren't changed, each differential backup is likely to take more media. However, even if the last differential backup required 7 tapes, the total number of tapes required to restore the backup would only be 11 (4 from the full backup plus 7 from the last differential backup). In most cases, you use fewer tape cartridges to restore your system to its last backed-up state with a differential backup because you only need to restore the full backup plus the last differential backup.

Incremental Backups

The other major method used for changed-file-only backups after a full backup is performed is the incremental backup. In an incremental backup, only files changed since the last full or incremental backup are stored. When a file is backed up using the incremental method, the archive bit set when the file was first created or was edited is cleared.

Incremental backups are much quicker to perform and require fewer tape cartridges or other media than differential backups. However, to restore a system to operation after a system crash, you must restore both the full backup and then all incremental backups made in the meantime. For example, assume that a full backup required two tape cartridges, and each incremental backup (performed weekly) required one backup cartridge. If the server crashed after a three-month period, you would need to restore about 16 tapes: 4 from the initial full backup and 12 (1 per week) incremental backup tapes, in order from oldest to newest. Even if each incremental backup used only part of a tape, that's a lot of media to restore.

Open File Backups

Open files create a major problem for reliable server backup. In recent times, servers are frequently running around the clock, 24/7, to provide access to files at any time, day or night. Thus, instead of there being several hours of inactivity during which all data files could be closed, backups are often performed while a server is providing data to some users.

Traditional backup programs cannot back up open files, meaning that the most important (or most used) files might not be backed up at all. To make certain that important files are backed up, server backup programs often include or can be upgraded with open file backup features. If your current backup program does not include or cannot be upgraded with open file backup, you should consider upgrading to a version that does support open file backup, especially if you must run backup while users are accessing files.

One method of performing open file backup is the Volume Shadow Copy Service (VSS) included in Windows 2003 Server.

Volume Shadow Copy Service (Snapshots)

Windows 2003 Server includes VSS as a method of backing up open files. VSS also protects files from accidental deletion or replacement on network shares.

VSS is supported on NTFS volumes only. It is enabled through a drive's properties menu. You click the Shadow Copies tab to enable or configure VSS for a particular drive. You can store VSS copies on the same drive letter or, preferably, a different drive letter.

The drive used for shadow copies must have at least 100MB of free space. You can limit the space used for shadow copies, but keep in mind that Windows 2003 Server can maintain up to 64 versions of each file. If you are not concerned about disk space, you should not limit the size of the shadow copy storage area. Windows deletes the oldest files if space becomes limited.

After a server has VSS enabled, you must install the Windows shadow copy client, which is available in the \System32\twclient\x86 folder located in the server's system (\Windows or \WinNT) folder. This client will work with Windows XP Professional. For Windows XP Professional and Windows 2000 clients, you can obtain a shadow copy client from www.microsoft.com/windowsserver2003/downloads/shadowcopyclient.mspx. You must use Windows Installer 2.0 or later to install the client.

After the client has been installed, a new tab called Previous Versions shows up in the properties sheet for network shared folders and files stored in folders on volumes running VSS.

To retrieve deleted files, you go to the network shared folder, open it, right-click an empty area, select Properties, and click the Previous Versions tab. Then you select the version and copy or drag it to the user's PC.

To retrieve a previous version of a corrupted or overwritten file, you right-click the file, select Properties, click Previous Versions, and select Restore (to replace current version) or Copy. If you select Copy, you need to choose a location for the file.

To recover a deleted folder, you open the folder that contained the deleted folder, right-click an empty area in that folder, select Properties, and click Previous Versions. Then you choose Copy to copy the folder and all contents to a location you specify. Next, you click Restore to recover the folder and all contents to the current folder.

If you use NTBackup as your server's backup utility, you need to run NTBackup from the command line to enable or disable backup of volume shadow copies. To enable backup of volume shadow copies, you use ntbackup/SNAP: on; to disable volume shadow copy backup, you use ntbackup/snap: off.

Deciding Which Backup Methods to Use

As you can see from the previous sections, a full backup is not the only backup method you should depend on. You should supplement a full backup with some type of changed-file backups, and, for extra security, implement volume shadow copies if you use Windows 2003 Server. For most users, a combination of full and differential backups produces the easiest type of backup to manage and restore.

One easy method for combining full with differential backups is known as the grandfather, father, son (GFS) method. GFS assumes daily backups on a weekly cycle. Before starting GFS, you should have a full backup. Then you create daily differential backups Monday through Friday and a new full backup on Saturday. The daily differential backups are known as the son, and the weekly full backup is the father. You repeat this weekly. The full backup on the last Saturday of the month (the grandfather) is considered a monthly backup and should be placed into permanent storage. You replace its media with new media.

Verification and Restoration

A backup of any type is worthless if it can't be restored. To make sure a backup can be restored, you should use verification. Modern tape backup systems covered earlier in this chapter perform read-after-write verification to make sure that data can be read immediately after it is written to tape. If a particular file cannot be read, the drive will write it again.

File Verification in Backup Programs

Note that read-after-write verification is not supported on D2D or removable-media backups. In such cases, you should select the option to verify data after backup in your backup application. You might want to use this option the first time you run a tape backup as well to assure yourself that the backup is valid.

With tape backup, the verify after backup option rewinds the tape to the beginning and compares each backed-up file to the file on the source drive, using some type of checksum comparison. If more than one tape was used for the backup, the first tape must be inserted, followed by each subsequent tape. If multiple removable-media or DVD discs are used, the first cartridge or disc must be inserted when prompted, followed by each subsequent cartridge or disc. D2D backups are the fastest and easiest to verify because the backup media does not need to be rewound or inserted.

If you see errors during verification, you should note which files caused the error. If the files were open during backup, you need to enable open file backup with third-party backup software or volume shadow copy backup with Windows 2003 Server and NTBackup. If the file was not open but could not be verified, you might have problems with the source drive or with your media. In that case, you should schedule a disk check with the option to fix file system errors and repair bad sectors. Then you should rerun the backup process and specify backup of only files that did not verify. If problems persist after disk checking, you should clean the tape drive and try a different brand of media.

Restoring Files from a Backup

If a file is damaged, overwritten, or deleted, you can restore it from backup media. You start the backup program and select the option to restore specified files. To ensure that you are restoring the latest version of a data file, you start the restoration process from the latest backup set. Normally, the backup program stores a catalog of each backup. However, if the backup catalog is lost, it can usually be re-created from the backup media.

After the catalog is retrieved or re-created for the latest backup, you need to locate the file(s) to be restored and select them for restoration. The backup device will locate the files, and the backup program will write the files back to their original locations. If you are restoring a good file to replace a damaged or incorrect file, you will be prompted to permit the replacement.

Restoring a Crashed Server Using Disaster Recovery

If you need to restore a crashed server, the easiest way to restore it is if you made a disaster recovery backup. Most modern backup programs support disaster recovery, which creates a full backup of the system and bootable media, enabling a "bare metal" recovery of the system to an empty hard disk. Depending on the backup program, a disaster recovery backup might be based on an image backup or a file-by-file backup.

You use the bootable CD or DVD you created to start the process. You insert your backup media when prompted until the system has been restored. Then you restore your daily backups. If you used the differential method, you need to restore only the last differential backup.

Restoring a Crashed Server Using ASR

If you used the ASR feature with Windows 2003 Server and need to restore from an ASR backup, you start the system with the Windows 2003 Server CD. When you see the prompt Press F2 to Run Automated System Recovery, you press the F2 key. Then you insert the ASR floppy disk. The system drive (usually the C: drive) is formatted by ASR. Afterward, a file copy process begins to restore a basic working copy of Windows 2003 Server. After the system reboots, the ASR Wizard starts and asks you where the ASR backup is located. After you specify the location, ASR restores information from your backup to your system drive.

After ASR is finished, you should restore other backups needed to complete the restoration of your system (such as the last full backup of non-system drives plus the most recent differential backup, or all incremental backups).

Restoring a Crashed Server Without Disaster Recovery or ASR

If you need to restore a crashed server without disaster recovery or ASR, follow this process:

1.	Partition and format the drive where you plan to reinstall the operating system.
2.	Reinstall the operating system.
3.	Reinstall the backup software.
4.	Restore the most recent full backup.
5.	Restore the most recent differential backup or all incremental backups.

As you can see, it's much easier and faster to take advantage of disaster recovery backups, or, at the very least, ASR backups, than to restore a system from scratch.

Hardware Compatibility

A full system backup, including disaster recovery and ASR backup, is designed to be restored back to the same system. If you are restoring a backup due to hard disk failure, you should make sure the replacement hard disk is the same type and size, or larger, than the original. The rest of the hardware is the same as before, so the backup will be restored to identical hardware.

It's a bit tougher if you must replace a failed server. In such cases, you should use a server that's the same model or, for white box built-it-yourself servers, use a server with the same motherboard, video card, and other add-on cards. If you use hardware with different specifications, the restoration might fail, or the system might not be bootable afterward.

Backup and Restoration Troubleshooting and Documentation

If you are having problems with backing up or restoring data, you need to first identify your problem from the following sections and then follow the steps for the solutions they provide.

Tape Retensioning

The solutions for many problems with tape-based backup devices involve retensioning one or more of the drive tapes. Retensioning a tape is the process of fast-forwarding and then rewinding the tape to ensure that there is even tension on the tape and rollers throughout the entire tape travel. Retensioning is recommended as a preventive maintenance operation when using a new tape or after an existing tape has been exposed to temperature changes or shock (for example, dropping the tape). Retensioning restores the proper tension to the media and removes unwanted tight spots that can develop.

The following are some general rules for retensioning:

Retension any tapes that have not been used for more than a month or two.
Retension tapes if you have errors reading them.
Retension any tapes that have been dropped.
In some cases, you might need to perform a retension operation several times to achieve the proper effect. Most tape drive or backup software includes a retension feature as a menu selection.

Backup or Restore Operation Failure

If your tape drive suffers a backup or restore operation failure, follow these steps:

1.	Make sure you are using the correct type of tape cartridge.
2.	Remove and replace the cartridge.

3.	Restart the system.
4.	Retension the tape.
5.	Try a new tape.
6.	Clean the tape heads.
7.	Make sure all cables are securely connected.
8.	Rerun the confidence test that checks data transfer speed with a blank tape. (This test overwrites any data that is already on the tape.)

Bad Block or Other Types of Media Errors

To troubleshoot bad block or other types of media errors, follow these steps:

1.	Retension the tape.
2.	Clean the heads.
3.	Try a new tape.
4.	Restart the system.
5.	Try initializing the tape.
6.	Perform a secure erase on the tape. (Previous data will no longer be retrievable from the tape.)

System Lockup or Freeze While Running Tape Backup

If your system locks up or freezes while running a tape backup, follow these steps:

1.	Ensure that your system meets at least the minimum requirements for both the tape drive and the backup software.
2.	For ATA/IDE (ATAPI) tape drives, make sure the tape drive is using a different host adapter than the hard disk. Set the CD or DVD drive to master and the tape drive to slave if both are using the same ATA/IDE port.
3.	For SCSI tape drives, check device IDs, particularly if a new SCSI device has been installed since the last time the tape drive was used. Note that most vendors recommend that the tape drive be on a separate bus from the system's SCSI hard disk or SCSI RAID array.
4.	Check the BIOS boot sequence; ensure that it is not set to ATAPI (tape/CD-ROM) devices if the tape drive is configured as a master device or as a slave with no master.
5.	Make sure the hard drive has sufficient free space; most backup programs temporarily use hard drive space as a buffer for data transfer.
6.	Hard drive problems can cause the backup software to lock up. Check your hard disk for errors by using CHKDSK or a comparable utility.
7.	Check for viruses.
8.	Check for previous tape drive installations; ensure that any drivers from previous installations are removed.
9.	Restart the server in VGA mode. If the problem does not recur, contact your graphics board manufacturer for an updated video driver.
10.	Disable antivirus programs and Advanced Power Management.
11.	Try the tape drive on another computer system and different operating system, or try swapping the drive, card, and cable with known-good, working equipment. Start by swapping the cables.