I was recently asked about best practices for a business to reconstruct its data after a disaster by John Edwards, TechTarget. John included my tip noting that once a disaster involving data loss is identified, you must act fast to preserve your environment to prevent further damage, and to protect the archived data itself. Here are some addition tips for reconstructing data after a disaster:

1.What’s the best way for a business to reconstruct its data after a disaster?

When a disaster involves data loss, it is often difficult to be sure of what data was destroyed or corrupted.  Unless of course, there is complete data loss or incidents involving Ransomware or encryption. For that reason, it is often best to conduct a complete restore of the device or server affected using an image.

2. How should the process be handled if the data is stored on various platforms?

The process should not vary greatly based on the platform alone, however, the restore options will vary slightly.

3. How can reconstructed data be verified for accuracy?

Assuming technical solutions to verify accuracy, such as Checksum are not available, the best method to verify accuracy is the manual comparison of the restored data against the transaction logs.

4. What steps should be taken if some critical data is missing?

During any restore process, it is very likely that some amount of data will be lost.  This can be minimized by near real-time replication. However, no method will ensure complete restoration of data in all situations.  Gaps in data must be recreated using the transaction logs noted in step 2.

5. What are the biggest mistakes business make while reconstructing data?

It would be a mistake to assume that file level restores will correct an incident.  For example, during a virus attack, it may appear that the target was a single file, folder or user.  In reality, the target may be much bigger, and a seed may have been embedded to inflict wide spread damage during a timed event.  Many times, the only way to rid the network of all damage is to image restore back to a specific date and time prior to the incident.

6. Do you have anything else you would like to add?

Redundant and geographically disperse backups provide many benefits and options.  Having the ability to file level restore or image restore provides great flexibility, while also providing a second copy of the data if back up data is also affected by the disaster.