Wednesday, May 25, 2016

Where Does Data Go?

I work in tech support. No matter that my degree is in networking, a lot of what I do is direct desktop support dealing with users in a university setting.

I am going to say to all of you exactly what I would like to say to my users. No one cares about your data except you. No one. Because I am a professional, I will murmur comforting thoughts when all your data is gone and keep the thought that you have acted like a moron to myself, but really, I don't care. It's not my job to care, I am not responsible for your data, I am responsible for the system and the software.

Back up your data. Then back it up again. Automate the process.

Before it is lost, however, I am a willing tech support guy, happy that you are trying to be a responsible adult and open to providing options, software solutions, advice, etc. The university provides server based storage for all faculty and staff and just doubled the size of everyone's share with an easy way to get more space if you have large data sets.

That server based storage is:
1. backed up daily, then weekly, then monthly, back through a year. 
2. accessible from off campus through a secure method.
3. considered secure, meaning that if it got compromised it is not the user's responsibility.

For personal use, I recommend a set of portable hard drives and automated backup software. Swap out the drives every month. Store the second drive in a different location than the computer. That will mean you don't lose more than a month if the entire system is destroyed. The daily automated backup ensures whatever you designated to back up is secure from a single hard drive or computer failure and you don't lose more than a day.

If that seems onerous, just use an attached hard drive backup for the daily backups and pay an on-line service to provide you with the offsite long term storage.

What you should not do:
1. Ignore the advice to set up a backup solution.
2. Pretend that data you didn't back up is important.
3. Pretend that data you didn't back up is important, really, the proof that it was not important is that you didn't back it up.
 Here is a list of some of the things that can happen. I chose these because they are all things that have happened to users I support.
1. Total, sudden, catastrophic hard drive failure.
2. Pouring a water tumbler full of gin and tonic on a laptop.
3. Having a cat pee on a laptop (leading to hard drive failure).
4. Pouring coffee on a laptop.
5. Dropping a laptop (leading to hard drive failure).
6. Having a computer stolen (the drive might be fine, the data is gone)
7. Having a virus (many many times, sometimes leading to data loss).
8. Having the Ransomware virus (once, data gone).
Sometimes I have been able to recover their data from the damaged system and I will if I can. Once we sent a drive out to a recovery service. That data was considered important enough to justify the $2200.00 charge.

My job is to repair or replace the computer, operating system, and software. I will do that, set you back up and restore your network access, configure your email and connect you to the network printer.

If you had five years of research data, the great American novel, all the pictures of your family since you first bought a digital camera in 2003, fifteen years of email archives, or anything else that suddenly became important after the screen went blank, ask yourself this question; "Where does data go when the only copy of it is destroyed?"

Next time I'll talk about anti-virus and personal computer security.

Back your shit up.


Borepatch said...

Excellent advice. I've had panicked friends call me when they got infected, afraid that they would lose all the pictures of their kids. USB hard drives are so cheap these days that there's no reason not to have 3 or 4.

R.K. Brumbelow said...

OK AMS and Borepatch may appreciate this anecdote:
While working as a forensics tech for a PI firm in Dallas, TX, one of our Lawyer clients called in in desperation. He had lost his entire database of clients, cases etc and did not know what had happened to it.

Here are the steps he had taken:
In Outlook he had dragged the "database" to his desktop
He then deleted the original Database.

My response to him was simple, do not turn off the server ( an exchange system) simply unplug it and send it to me via courier, I will recover the data and send it back to you via courier. ( I was out of town at the time) I promised same day service and he would be back up and running very quickly, since he was a client of the PI, it would simply be the standard charge of $300 an hour plus courier fees and we were going to cover the courier fees by having one of our people pick up and deliver the system.

He decided to call someone else.

Now what is particularly funny are the details of what happened. First the exchange server had its database sitting on a compressed encrypted NTFS drive on a Windows server. The database was approximately 600MB in size (compressed) and was sitting on a 200GB drive (yes he had a 600MB database on its own 200GB drive and decided to compress the drive)

The Tech he called in gracefully shut down the exchange server by issuing the shutdown commands and then proceeded to inform him the data was irrecoverable. Those that know about old exchange systems know that the log is written on a time basis or when the shutdown command is entered, flushing the cache. (This was why I told him to simply unplug the machine)

He had of course simply copied a link to the original data to his desktop then deleted the referred to database.

It took me over a week at $300 an hour plus literally reading differential magnetic levels on the securely deleted and compressed encrypted drive to recover his data. That's right what shoudl have been a simple recovery turned into a 50 HR, $15,000+ job. He did get all of his data back though.

I did ask him later what he would do when a tech told him to do something with his computer next time, he said he would actually follow the techs instructions.

Expensive lesson, but I think he learned it. Also, don;t compress drives for no reason, it annoys the data recovery person if it gets that far and all it does is slow down the computer.

Yes, if he had backed it up, used an off site backup (this was the early 2000's so I was recommending nightly backups plus rotateing tapes offsite for storage and monthly / weekly tapes for high value clients being stored at seperate facilities (like Bank safety deposit boxes) back then as online backups were very uncommon but a simple backup would have sufficed.

At another facility we were upgrading a local cities computers and the Mac users all got the great idea that he best place to store their personal documents was the trash can. Their reasoning was that when the computer profiles got migrated, the trash would still be there so they could get it out and we would not have moved it. Heh. That went over well. I think that was when one of the novel login button DLLs was being overwritten by another applications files and the button became invisible, but that is another story of how we figured that one out for a different day.

thesouthtexaspistolero said...

Crashplan and external drive FTW. I will say that have been quite lucky so far; I just bought my third Mac, and I have been able to transfer data from the first one to the second one AND from the second one to the third one by just yanking the drive from the old one and connecting it to the new one via a SATA to USB cable and pulling it over manually, but I keep the Time Machine backup current just in case. Crashplan is great because it works automatically.

Divemedic said...

I recently did this with a NAS drive. I bought a QNAP TS-251 NAS drive. It has two bays. You can get one with a pair of 2TB hard drives for less than $450. Run it in a RAID 1. The system is Linux based, and will automatically backup 2 copies of your files in real time.

It can be set up to be accessible online from anywhere, and encrypts the files as it writes them.

Cecil Henry said...

I have come to love the WD my passport automatic backup HDD.

Piece of mind and security all the time. So simple.

Bill Matthey said...

I aint backing up shit!
If it fails, Oh Well.
Nothing on my system is of value. Period.
It's full of emotionally valued things like pictures and nice sounding emails. But in terms of value to my every day life ... Zero.

ASM826 said...


That is certainly the other perspective and one I can respect.


Unknown said...

Having done the same job in the same setting I see the same stories. The best classic for me was the Professor who was too busy completing his Doctoral dissertation to pay attention to the Magistr virus on his system (main symptom icons run away from the cursor). Two weeks before his dissertation was due, it formatted his HD.

No backups

No money to pay for recovery services

Of course to him it was all IT's fault. Our director (literally) told him to piss up a rope.