Dell Data Protection Foundations cheat sheet

RPO = maximum acceptable data loss measured in time before an incident; RTO = maximum acceptable time to restore service after an incident.

Backup is a point-in-time copy retained for recovery; replication is a continuous copy used for availability or DR; archive is long-term retention for compliance.

The 3-2-1 rule: at least 3 copies of data, on 2 different media types, with 1 copy offsite (modern variants add 1 immutable or offline copy).

Ransomware resilience requires at least one immutable, offline, or air-gapped copy; deletion of backups is a primary attacker objective.

Data growth, shrinking backup windows, virtual machine sprawl, and multi-cloud fragmentation are the dominant operational challenges.

Deduplication reduces storage by storing unique blocks once; compression reduces size via encoding; both change capacity math but not RPO/RTO.

Recovery point granularity (per-hour, per-minute, continuous) and retention duration directly drive capacity and cost.

A backup that has never been test-restored is an unverified assumption, not a recovery capability.

Core components: protection policy, backup client/agent or agentless proxy, backup server, target storage (DDVE/appliance), catalog, and media server.

Full backup copies all selected data; incremental copies changes since the last backup of any type; differential copies changes since the last full.

Synthetic full is constructed from a prior full plus incrementals without re-reading production data; active full re-reads production.

Forever incremental retains a chain of incrementals and synthesizes fulls on demand; chain length affects restore time and risk.

Change Block Tracking (CBT) and Changed Block Tracking for hypervisors identify modified blocks to enable incremental VM backups.

Instant access / instant recovery mounts a backup image directly to run a VM or application without a full restore.

Catalog stores metadata mapping backups to source objects, enabling search, restore selection, and retention enforcement.

Data Domain uses inline variable-length deduplication with a stream-informed segment layout; DDVE is the virtual edition deployed on supported hypervisors or cloud.

Backup types by scope: image-level (whole VM/volume), file-level, application-consistent (VSS or equivalent), and crash-consistent.

Application-consistent backups quiesce the application and flush buffers; crash-consistent backups capture disk state without application coordination.

Grandfather-father-son (GFS) retention keeps daily, weekly, monthly, and yearly restore points; retention policy determines how many of each are kept.

Restore options: full restore, file-level restore, granular application item recovery (mailbox, object, table), and bare-metal recovery.

Verification steps: checksum or hash validation, catalog consistency check, and periodic test restores to a non-production environment.

Backup window is the time allotted for backup jobs; exceeding it causes job overlap and missed SLAs.

Recovery time increases with chain length and target media; disk-based recovery is faster than tape-based recovery.

A recovery plan must specify restore order (dependency sequencing) for multi-tier applications.

Synchronous replication acknowledges writes only after the remote site confirms; RPO is zero but latency limits distance.

Asynchronous replication acknowledges locally and ships changes later; RPO equals the replication lag.

Replication topologies: one-to-one, one-to-many, many-to-one, bi-directional, and cascade/chain.

Failover promotes the replica to primary; failback returns operations to the original site after recovery.

Split-brain occurs when both sites accept writes; quorum or witness components prevent it.

DR tiers: hot site (near-zero RTO), warm site (hours), cold site (days); site choice follows RTO/RPO and budget.

DR testing types: tabletop, simulation, and full failover; only full failover validates actual RTO.

Replication of backups (not just production data) protects against site loss and ransomware that targets primary storage.

PowerProtect Data Manager is the centralized software-defined protection platform for virtual, physical, and cloud workloads.

PowerProtect DD series appliances and DDVE provide deduplicated backup storage; Data Domain is the established product family name.

PowerProtect Data Manager supports application-aware protection for databases, file systems, and Kubernetes, plus cloud-native workloads.

NetWorker is the enterprise backup and recovery software for heterogeneous physical and virtual environments with tape and disk targets.

Avamar provides source-based deduplication with grid architecture; it is often deployed for remote-office and VM protection.

RecoverPoint provides continuous data protection and replication for block and file workloads with journal-based rollback.

PowerProtect Cyber Recovery creates an isolated vault with air-gapped copies and analytics for ransomware recovery.

CloudIQ and PowerProtect Data Manager dashboards provide monitoring, capacity forecasting, and compliance reporting.

Agentless VM backup uses hypervisor APIs (vSphere VADP, Hyper-V VSS) through a proxy appliance rather than an in-guest agent.

VM image-level backup captures the full virtual disk; guest-level backup captures files inside the guest OS.

CBT enables incremental VM backups by tracking changed blocks between snapshots; a CBT reset forces a full backup.

Snapshot-based backup requires consolidation and cleanup; orphaned snapshots consume datastore space and degrade performance.

Cloud protection patterns: backup to cloud object storage, cloud-to-cloud protection, and SaaS application backup (e.g., Microsoft 365).

Kubernetes protection requires application-consistent snapshots of persistent volumes plus namespace and configuration object capture.

Cloud storage classes (hot, cool, archive) trade retrieval cost and latency against retention cost; align class to retention and restore frequency.

Cross-cloud and cross-region replication supports DR and data residency requirements.

Job states: queued, running, succeeded, failed, and cancelled; failed jobs require triage before the next window.

Key metrics: job success rate, backup window compliance, deduplication ratio, capacity utilization, and restore test pass rate.

Alerting should be tiered by severity; critical alerts cover failed backups of tier-1 assets and capacity thresholds.

SLA reporting maps protection coverage to RPO/RTO commitments per application tier.

Capacity forecasting uses growth rate and retention changes to predict when additional storage is required.

Change management applies to protection policies, retention changes, and agent upgrades; unmanaged changes cause coverage gaps.

Runbooks document restore procedures, escalation paths, and contact lists; they are tested during DR exercises.

Automation via APIs and orchestration reduces manual error and enforces policy consistency across environments.

Encryption at rest protects backup data on disk; encryption in flight protects data moving between client, server, and target.

Key management separation: backup encryption keys should not reside solely with the backup data they protect.

Immutability (WORM) prevents deletion or modification of backups for a defined retention period; it is a core ransomware control.

Role-based access control limits who can delete backups, change retention, or perform restores; separation of duties is required.

Audit logging records administrative actions and restore activity; logs must be retained and protected from tampering.

Compliance frameworks (GDPR, HIPAA, PCI DSS, SOX) impose retention, privacy, and access requirements on backup data.

Data residency rules constrain where backup copies may be stored; cloud region selection must comply.

Legal hold suspends deletion of specified data regardless of retention policy expiration.

Sizing inputs: protected capacity, change rate, retention period, backup frequency, deduplication ratio, and growth rate.

Required backup storage ≈ protected capacity × (1 / dedupe ratio) × retention multiplier, adjusted for full/incremental mix.

Deduplication ratio depends on data type; databases and VM images typically deduplicate better than pre-compressed or encrypted data.

Network sizing: backup throughput must fit the window; throughput = data volume / window duration, accounting for protocol overhead.

Design for the restore, not just the backup: validate that RTO is achievable with the chosen media and topology.

Tier workloads by criticality; apply stricter RPO/RTO, immutability, and replication to tier-1 assets.

Avoid single points of failure: redundant backup servers, storage, and network paths for tier-1 protection.

Document the design with an architecture diagram, data flow, retention matrix, and test plan; review after major changes.