[NTLUG:Discuss] need to recover deleted files ( and more )

[Steve Baker]

Jack Snodgrass wrote:
> On Sat, 2003-02-08 at 10:19, Kenneth Loafman wrote:
> 
>>Ask your sysadmin about backups.  He does do backups on a regular basis, 
>>right?  If not, then its almost impossible to recover deleted files on 
>>*nix file systems.  It's a security issue.
>>
>>...Ken
>>
> 
> There are a coople of programs out there for linux ext2 file systems, 
> that have a chance of working if your quick. Not something you want
> to have to rely on. 

He said it was a Solaris system. :-(
> Besides system backups ( the other day we discovered that our 
> MIS department 'thought' that they were backing up our server 
> but they were not. We needed something that was deleted and 
> they discovered that they were not doing what they told us that
> they were doing )

I had a similar experience - our IS department were using 'incremental
backups' - meaning that they only backed up what had changed.  To restore
a directory someone deleted by mistake entailed reloading something like
50 tapes!

> I use a cron job that tars up my source area
> on my web server, and SCPs each days tar file to a remote server. 
> I have a file for each day that is replaced each day execpt for
> the 'sunday' copy that I keep. So I have weekley backups that are 
> permant and daily backups that last a week. 

Yep.

I like to distinguish between "Ooops" recovery backups, "Disk crash"
backups and "Meteor strike took out the building" backups.

Stage I: "Ooops" recovery entails doing a backup at least once or twice a
day - so that if you delete a file, you don't waste more than a day or
so of effort.  But you can do that by (for example) copying the user
directories from one disk partition onto another...preferably on another
drive.

Stage II: Disk crash recovery traditionally requires messy tapes,
CD writers or whatever - which inevitably require human intervention -
which is error-prone. But with disk drives costing less than $1 per
Gigabyte, hard disk space is now nearly as cheap as blank CD-R's!
It's probably better to have two big drives in each machine and
just copy one onto the other overnight.   You run the risk that
one or other drive might die during the copy process - but that's
pretty unlikely.  The biggest risk is that something might go wrong
with one drive - but go undetected until it's (now faulty) contents
copied over your backup.  Having a number of backup drives used in
rotation could fix that too.

Starge III: Meteor strike (or building burned to the ground or whatever)
recovery requires that you physically take your data off to another
site...put perhaps only once a month.  You could probably just use
demountable hard drives for your stage (2) backups and cycle a set
of three or four drives through the system, making sure that at least
one or two of the drives are kept off-site.
---------------------------- Steve Baker -------------------------
HomeEmail: <sjbaker1 at airmail.net>    WorkEmail: <sjbaker at link.com>
HomePage : http://www.sjbaker.org
Projects : http://plib.sf.net    http://tuxaqfh.sf.net
            http://tuxkart.sf.net http://prettypoly.sf.net