Backup and Recovery Fundamentals
Domain 3 tests backup and recovery mechanics: which backup type to use, how a restore chain works, how retention schedules behave, and how deduplication changes capacity math. Expect calculation and troubleshooting questions.
Core rules
- Full backs up all selected data. Incremental backs up changes since the last backup of any type. Differential backs up changes since the last full. Restoring an incremental requires the last full plus every incremental to the target point; a differential requires the last full plus the latest differential.
- Synthetic full creates a new full from a full plus incrementals on protection storage. Forever incremental uses a synthetic full process to avoid recurring production fulls.
- GFS rotates daily, weekly, monthly, and yearly retention. Retention determines when a copy can expire; it does not determine when a job runs.
- Recovery granularity ranges from a single file to an application, VM, or bare metal system. Bare metal recovery restores an OS and configuration to dissimilar hardware using drivers and a boot image.
- Instant recovery runs a VM or application from protection storage to shorten RTO, then migrates back to production.
- Verification should include restore tests, not just job success. A successful backup job only proves data was written.
Worked example
A 10 TB full runs Sunday. Daily change is 2% of the full, or 200 GB. Six daily incrementals add 1.2 TB, so the week stores 11.2 TB before dedupe. At 5:1 dedupe, that is about 2.24 TB. For 13 weeks, capacity is roughly 29 TB plus metadata and overhead. To restore Thursday, the administrator needs Sunday's full plus Monday through Thursday incrementals. If Tuesday's incremental is corrupt, the chain breaks at that point. A weekly synthetic full consolidates the chain and reduces restore risk, at the cost of protection-storage processing.
Traps that cost marks
- Thinking a differential restore needs every differential.
- Confusing retention with schedule.
- Assuming dedupe applies equally to encrypted or compressed data.
- Reporting success without a restore test.
- Forgetting catalog, metadata, and overhead in capacity estimates.
- Using instant recovery as a permanent production location.