Following up on the back-up theme from last week's Tech Tuesday post, RAID is not Back-up, I'm going into a little more depth on some back-up options and what each of them offers. This week I want to talk about 3 very popular options; mirrors, snapshots and incremental back-ups.
Mirrors
This is really a bit of a follow-up from last week's discussion on RAID vs. back-up. One very common RAID level is RAID 1, also known as a mirror. This involves taking 2 identical disks and setting them up so that whatever is written to 1 is written to the other disk at the same time. As mentioned last week, this is great for reliability and that's why I'm including it here as part of a back-up strategy. The idea is 1 of the drives can fail and you'll still be up and running with the other drive. As mentioned last week, this is great for protecting you against drive failures but it doesn't help you recover an individual file. If you accidentally change or delete a file it's going to be changed on both drives.
There is another type of mirror that doesn't involve RAID. Rather than setting up a RAID you can keep a second disk which is an automatic back-up of the main drive. The idea here is very similar to RAID 1 but the copying would be less frequent. With RAID 1 all changes are written to both disks at the same time. Instead, you could setup your mirror drive to be written to every hour, or possibly just at the end of the day. The big advantage is that if you do accidentally delete a file you can still find it on the mirror drive. The other advantage is that you can turn off that mirroring when you are making major changes (such as installing updates) and want to make sure that you can back out of the changes if necessary (more on this next week).
Ideally, you should be able to boot your computer from this mirror. That's extremely useful if an update goes catastrophically wrong and your main drive is in an unusable state. I don't want to get into a Mac vs. PC debate but this is one area that is significantly easier to manage on a Mac since you can always startup off of any drive that has Mac OS X installed and you don't run into any issues with drive letters changing or similar. I'm not saying it can't be done on a PC, there just may be more involved in setting it up.
The big downside of this variation is time. It takes a lot longer to copy over all of the data. In order to ensure that all of the data is exactly the same the mirror should take a complete copy of the original disk, you can't really reliably just copy things that changed. The idea is that every byte on the back-up drive should be identical as the first drive and that requires a lot of time to copy and verify.
Snapshots
A snapshot is pretty much what it sounds like; it's a back-up strategy where you take an exact copy of the drive as it is right now. Depending on your back-up software this may be a compressed copy or simply a full copy of all of the files stored in a folder on another disk. The big advantage over a mirror (especially a RAID 1 mirror) is that you should be able to recover a file that you accidentally changed, just grab it from the snapshot. The exact steps involved with this will depend on your back-up software.
Obviously one of the big disadvantages for this strategy is disk space. If you have 2TB of data and take a full snapshot of that data every day then even after a single week you'll need 14TB to store that! That's one of the main reasons why back-up software will normally compress the back-up. This will add some time in creating the back-up and in restoring any particular file but the savings in storage space may make it worthwhile.
Typically, when working with snapshots you'll setup some type of strategy for rotating out old copies. One common strategy is to take a daily snapshots and then only keep 1 snapshot from the previous weeks going back a month and then only keep a single monthly snapshot going back to whatever period you feel you'll need. A lot of this can depend on how much data you have and how far back you may need to go. Yes, this can take up a lot of space but don't underestimate the value of being able to go back a few days, or even weeks, when it's some time before you realize that you deleted the wrong file.
Incremental back-ups
Incremental back-ups are often combined with snapshots. As outlined above, snapshots can take a lot of time to create and eat up a lot of space. Instead of creating a full snapshot every day most back-up software can instead create a full snapshot less frequently and then simply save a back-up of any files that have changed since the last back-up separately.
Obviously this can save a significant amount of space, how much will depend on how many files you change (or new files you create) in between back-ups but it's always going to take up less space than a full snapshot. The big downside is you don't have a full snapshot of the state of your disk as often. This can prove to be a major issue if the last snapshot turns out the be bad. For example, suppose that you take weekly snapshots and then do incremental back-ups throughout the week. If it's day 6 of your incremental back-ups when your disk fails then you may be faced with losing a lot of last week's work. The other downside is that it can take your back-up software a lot longer to restore all of your files as it first has to restore the snapshot and then step through each incremental back-up from that point.
So where does Time Machine fit into all of this?
So far I've tried to stay more theoretical but since every recent version of Mac OS X includes Apple's Time Machine software for backing up I thought it was important to touch on it a little bit, especially because it doesn't really fit into any of the options I've outlined above.
Essentially, Time Machine does a bit of a mix between a snapshot and an incremental back-up. When Time Machine runs for the first time it makes a complete copy of the contents of the drive(s) you're backing up. After that, it runs periodically (hourly by default) and makes a new copy of any files that have changed since the last time it's run. So far this sounds a lot like an incremental back-up right? The big difference is that due to the way Time Machine stores the files you will always be able to get to all of the files as they looked at that particular point in time, even those that haven't changed. This makes it look a lot like you're taking full snapshots every hour since you see all of your files.
The important thing to realize is that while you can see all of your files for each time that Time Machine ran, it only writes a new copy of files that have changed. This means that while all of the unchanged files show up for that time period they aren't a separate copy, they're the exact same file as was written to the disk when that particular file changed, or potentially going all the way back to the initial snapshot. This does save a ton of space and it's a great piece of engineering to make restoring files easy but it's important to realize you will only ever have 1 copy of any change for a file.
When you get right down to it, Time Machine is really a system where a single snapshot is taken right at the beginning and everything after that is an incremental back-up. Don't get me wrong, Time Machine is a great back-up solution because of how simple it is and because Apple has done an incredible job of making back-up simple enough for everyone. The big thing to realize is that it should only be part of a complete back-up strategy that employs other options like those I've outlined above.
It's probably easiest to illustrate the potential issue with an example. Suppose you accidentally delete a file that you last worked on over a month ago. When you go back an hour in Time Machine and restore the file you discover that the file is corrupted. You don't panic right away because you think, "that's okay, I'll just go back further". But, you're sunk, the last time this file was written to Time Machine's back-up drive was a month ago when you last worked on it. While it will look like you have several copies of that file since then each of those will be the same corrupted file that you restored the first time. If you're lucky then you'll have another back-up in Time Machine from before the last set of changes that you made but then you're going to lose whatever those changes were.
Test your back-ups!
A final word on back-ups; if you're not testing your back-up strategy periodically then you really don't have a back-up strategy. A proper back-up strategy should always be tested. That doesn't mean you should format your main hard drive every week but at times you should be testing to make sure that you can restore your system from your back-ups. It's a terrible feeling to think that you're properly protected when your system fails only to discover that your back-ups are missing crucial files, or simply don't work. Better to discover this before you have a problem so that you can address any shortcomings ahead of time.