Different DATA Backup Strategies , Focused on CISSP

"Organizations should have a backup strategy for several reasons, such as Data Loss Prevention, Business Continuity, Compliance, Disaster Recovery, etc.

Now, here's a brief explanation of three common types of backups:

Full Backup

A full backup involves copying all the data in a system or a specific dataset to a backup destination. It creates an exact replica of the data at a specific point in time. Full backups are comprehensive but can be time and resource-intensive.

Incremental Backup

Incremental backups capture only the changes made since the last backup, whether it was a full or incremental backup. These backups are more efficient in terms of storage space and time, but restoring data may require multiple incremental backups in sequence.

Differential Backup

Differential backups capture all the changes made since the last full backup. Unlike incremental backups, which only track changes since the last backup of any type, differential backups track changes since the last full backup. This makes restoring data quicker compared to incremental backups, as you only need the last full backup and the most recent differential backup.

Confused? Let me explain with a quick and easy example.

Scenario 1:

• Full Backup happens on a DB every Sunday evening
• Differential Backup every 24 Hours at noon.

Now consider you have to restore a system that lost data on Wednesday evening , let's see how we can restore it with Full Backup and Differential Backup Files.

The Full Backup file from Sunday Evening will make your system up-to-date with data until Sunday.

Now you have the Differential Backup Files of Monday, Tuesday, and Wednesday. Which one will restore your data, all of them or any single one?

If you look at the definition closely, the Differential backup file captures all changes since the last full backup. The file on Monday's Differential Backup will have changes captured from Sunday evening's full backup up until Monday's Differential backup. Moving to Tuesday's Differential Backup file, it will capture all changes from Sunday evening's full backup until Tuesday's Differential backup file (that means it will have all changes, including Monday's file as well). Now, on Wednesday's Differential file, we will have changes from Sunday till Wednesday's Differential backup (That means it will have all changes, including Monday and Tuesday's file).

So, to restore your system that failed on Wednesday evening, you need to add a Full Backup file from Sunday and ONLY WEDNESDAY'S DIFFERENTIAL BACKUP FILE. Total 2 Files

Scenario 2:

• Full Backup happens on a DB every Sunday evening.
• Incremental Backup every 24 Hours at noon.

Now, when you have to restore a system that lost data on Wednesday evening, let's see how we can restore it with Full Backup and Incremental Backup Files.

The Full Backup restoration file from Sunday Evening will make your system up-to-date with data until Sunday.

Now you have Incremental Backup Files of Monday, Tuesday, and Wednesday. Which one will restore your data, all of them or any single one?

If you look at the definition closely, Incremental backup files capture all changes since the last backup, whether it was a full or incremental backup. The file on Monday's Incremental Backup will have changes captured from Sunday evening's full backup up until Monday's Incremental backup (Because Incremental Backup captures changes in data from the last Full backup or last Incremental backup, here the latest out of two was Full backup which happened on Sunday, that means changes between Sunday and Monday are stored in it). Moving to Tuesday's Incremental Backup file, it will capture all changes from Monday's Incremental backup file until Tuesday (Because Incremental Backup captures changes in data from the last Full backup or last Incremental backup, here the latest out of two was Incremental backup which happened on Monday, that means it will only have changes between Monday and Tuesday's file stored in it). Now, on Wednesday's Incremental backup file, we will have changes from Tuesday until Wednesday (Because Incremental Backup captures changes in data from the last Full backup or last Incremental backup, here the latest out of two was Incremental backup which happened on Tuesday, That means it will have changes only from Tuesday till Wednesday).

So, to restore your system that failed on Wednesday evening , you would need the Full Backup File from Sunday evening and ALL 3 INCREMENTAL BACKUP FILES. Total 4 Files

Wondering why we need Incremental Backup method since we had to restore a total of 4 files? Here's why -

Differential Backup Files are easy to RESTORE and Heavy to Create, and vice versa for Incremental Backup, easy to CREATE and complex to restore.

Still Wondering!

If you are wondering what happened to the data lost between NOON and EVENING on Wednesday, this depends on the organization's RTO/RPO policies. What is that? Will post something on this later!"