Administrative Restore

Transcription

1 Administrative Restore 1

2 Copyright Datacastle Corporation All rights reserved. Datacastle is a registered trademark of Datacastle Corporation. Microsoft Windows is either a registered trademark of Microsoft Corporation or a trademark of the Microsoft group of companies. Other product and company names including Datacastle are trademarks of their respective owners. Mac OS X, Leopard, and Snow Leopard are trademarks of Apple Inc., registered in the U.S. and other countries. Distribution of substantively modified versions of this document is prohibited without the explicit permission of the copyright holder. Distribution of this work or derivative work in any standard (paper) book form for commercial purposes are prohibited unless prior permission is obtained from the copyright holder. DOCUMENTATION IS PROVIDED «AS IS» AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. 2

3 Contents Administrative restore...4 Background...4 Help a user by starting a restore for them...4 Help a user by retrieving some files when they don t have their computer...6 Access backed up data for administrative or legal reasons...7 How does this work?...8 Managing restores and troubleshooting...9 3

4 Administrative restore This document describes how to use the administrative restore features to restore backed up data from devices, either for support purposes or for an ediscovery activity. V7.0 or above required (vault and client). Background Administrative restore adds a new option for accessing the data backed up from devices. The 3 options now available are: Restore using an activated client agent directly Retrieve individual files (as long as they are not too big) using Web Retrieve Restore to any activated client using administrative restore Administrative restore has been added to address a number of scenarios: 1. Help a user by starting a restore for them 2. Help a user who needs access to files in their backup when their machine is not available 3. Access the backed up data for administrative or legal reasons This document will go through details of each of these 3 scenarios, but they all work in basically the same way the administrator uses the dashboard to select the files and folders to be restored, then chooses where the restore is performed. The restore is always performed by an installed client, although it can be a client installed and activated as a different device to the one the data to be restored is coming from. Once the client picks up the job from the vault, it performs the restore in the same way as it would be done if the user had started in the client themselves (although they can t do that for a different device). This approach allows the administrative restore to be any size and number of files, and it will take advantage of all the technology that is normally used in restoring, including the ability to keep restoring through the machine being disconnected from the network or restarted, to use a QuickCache, to limit bandwidth for downloading data and managing the restore within the available disk space. If the restore is going back to the original device then it will also use any data still in the local cache. Help a user by starting a restore for them Today the normal way to access backed up data is by using the client installed on the protected machine to start a restore. This is something that many users can do for themselves, but there are some situations where this isn t the best way. When users don t restore often they may not feel comfortable doing this for themselves, and in fact some organizations prefer that their users always contact the help desk for restores. Prior to v7.0, the help desk needed to either talk the user through how to perform the restore or to connect to their machine in a remote session to start the restore. With v7.0 the administrator can access a Restore tab in the dashboard which is similar to the restore area in the client. From here they can start a restore which will run on the protected machine. From the user s perspective the files they needed restored will simply turn up on their drive. Along with the ability for an administrator to start the restore, a new policy item has been added which disables restore through the client. For those organizations which want users to contact the help desk 4

5 for all restores, they can set the policy User self-restore enabled to false. If the user happens to run the client and click the restore button then they will see a message that restore has been disabled and to contact an administrator to restore. That message can also be customized in the policy so the organization can direct users to the right helpdesk or other support location. To perform a restore for a user: Navigate to the device Go to the Restore tab Find the files to be restored, either by searching or navigating through folders Either select files and folders and click Restore selection or click Restore all matches to restore all files the system find matching your criteria. On the Add admin restore page, leave the default settings of restoring the most recent files unless the user is looking for assistance with finding an older version of the files. Select the location to restore to: o Original location will put the files back where they were protected from. This may be appropriate to restore a few files or a folder as the user will know where the files should be. Leave the default option of Rename in the list for Overwrite behavior so that if the files are already there the restored files will get a new name. o Click Change to enter a folder location. This is a folder on the user s machine, so make sure you select a location that will be accessible. A folder such as C:\Restore is suitable. If you want to restore to the user s documents folder or their desktop then you will need to determine the name of that folder as it is not always the user name. The service doesn t know which user profile on the machine is the correct one so there i s no way to automatically find these locations. Leave the default of restoring to the original device. Click Submit to add the restore job to the vault. Another situation where you may want to perform a restore for a user is when they are getting a replacement machine. In this case you may be creating a new device for the new computer, or you may be resetting their original device to reinstall. In either case, you can submit a restore to take all the data from the old computer and restore it to the new one. If the job is submitted while the restoring device is in either a created or reset state it will just wait until the device is ready and then the restore will start. To restore onto a replacement machine when you are reactivating their device to the new machine: Reset the device if you don t do this first and the machine is still being used the restore will start on the old machine Select the files or folders to restore Select a specific date and time for the restore such as now, or a short time ago. The reason for this is that when you install and activate on the new machine, there may be a backup performed before the restore is picked up and you don t want to include those files in the restore. Select the restore location you can choose original location, but some differences like a different OS version, different profile user directory name or different drive configuration may mean this puts files in the wrong locations so it is usually better to restore to a Restore folder instead and let the user know that s where their files will be. 5

6 Select Original device to do the restore and submit Now when the device is reactivated it will start restoring shortly after it downloads the information about the protected data. When you are creating a new device and restoring to that device, you need to have the new device ready first. Follow your normal deployment process, either creating the device or push the installation to the machine so it creates a device and activates automatically. Now follow the same restore process as above, but select the new device as the restoring device. If the client is already deployed the restore will shortly, otherwise it will start shortly after the client is installed and activated. Help a user by retrieving some files when they don t have their computer If a user doesn t have their computer with them they may need to retrieve a few files from their backup. For example, if they have lost their computer while traveling they may need a recent document or presentation. They can use the web retrieve feature for this but since users don t do this often they may not know how to use this site, or they may run into limitations as only one file can be retrieved at a time and there is a size limit. Administrators don t have access to this site, unless they log in as the user of the machine which stops them from helping much here. Administrative restore can be used to restore data on a different device than where it was protected. The administrator can take advantage of this by restoring the data using a device they have access to, such as the one installed on their machine, to restore the files needed. This form of restore has none of the limits of web retrieve any number and size of files can be restored, limited only by the amount of time the administrator or user is willing to wait. Once the files are restored the administrator could them to the user or move them to a network location the user will be able to access. To retrieve files for a user: Navigate to the device Go to the Restore tab Find the files to be restored, either by searching or navigating through folders Either select files and folders and click Restore selection or click Restore all matches to restore all files the system find matching your criteria. On the Add admin restore page, leave the default settings of restoring the most recent files unless the user is looking for assistance with finding an older version of the files. Select the location to restore to: o Original location is probably not appropriate since you aren t restoring to the original machine and this option could put the files in various locations on your restoring machine. o Click Change to enter a folder location. This is a folder on the restoring machine, so make sure you select a location that will be accessible. A folder such as C:\Restore is suitable, although if you do this for multiple users their files will all be in the same place. You could either manually add the user s name or other information to the path or use one or more of the tokens which will be expanded automatically the user s or the device name may be appropriate. You can also add the start time of the restore in case you are doing multiple restores for the same user. 6

7 Click Change under Restoring device to select a different device to perform the restore. o From the popup, search for the device you want to use to restore the data. You could enter part of your address in the search box to find your device for example. The device you choose needs to be activated with a v7.0 (or later) client to be able to restore. You can choose any device, even if it is not activated or is an older version and the restore will wait in the system until the device is activated/updated. Click Submit to add the restore job to the vault. You will now be on the Admin restores tab on the company with this job listed. Once the job shows as completed you can go to the machine and access the restored files to send them to the user in an appropriate way. Access backed up data for administrative or legal reasons Sometimes an administrator needs to access the data backed up from one or more machines. There are a number of reasons for this: the device may no longer be installed anywhere, perhaps because the user has left the company, or because it was stolen and replaced with a new device a manager may need to access important business data on an employee s device because they are unavailable, such as if they are out sick or on vacation data from a number of machines may need to be accessed for ediscovery for a legal case Prior to v7.0 the recommended way to handle these types of access was to reset the device, install and activate the client on a new machine and then perform a restore. This was not desirable because the original installation for the device would stop working once it was reset and it would need to later be reinstalled to keep protecting the data, and also because you would need to find another machine to use that didn t already have the client installed on it since the client can only connect to one device. With Administrative restore these situations can be handled by restoring using an existing client installation without any impact to the original device. For situations with restoring a single device this is handled in the same way as the previous scenario of retrieving data for a user. The administrator can restore the data to their own machine, or could restore it directly to the machine of the person who needs to access the data. If you need to restore from a number of devices or to do this type of restore often you may wish to set up dedicated restore devices. You can create and install these devices in the same way as any other, including pushing an automated installation. After installation you should assign them to a different policy, both because you probably don t want to back up all the data that gets restored there, and because you may wish to apply different policy such as bandwidth allowed for restores to these devices. To make the devices easy to find when selecting a device for a restore, either name them something like Restore1, Restore2 or put them under a user named Restore User. Finally, if you are using multiple restore devices then it will be convenient to have them all restore to the same place on your network so that you don t have to worry about connecting to the individual machines to find the files. This takes a bit of set up because the application agent needs to have access to the network location. Here are the steps needed: 7

8 Ensure that the machines where the restore device agents are running are domain joined Change the application agent to run as Local System Create a folder to be shared in a location on your network, and alter the security to give either Domain Computers (all computers) or the specific computers full control to that folder Share that folder and give Domain Computers or the specific computers full control on the share Now when you add an admin restore and select one of these restore devices you can also specify a UNC path such as \\Machine\Restore\{User }-{DateTime} which will create a folder with the user and the restore time in the name of the folder. If the user who needs the files also has access to that location they can access the files as soon as they are restored. If this is being done for an ediscovery type activity, you will most likely want to lock down this location so that only those people working on that activity have access, and the restore devi ces. You also probably want to include the device id in the path using the token {DeviceId}. Once the restore has completed you can use your ediscovery search tool on the data. The restore can do some basic file name and type searching, but in most cases it will be best to restore all the data, or all data of a certain type like documents and then use a dedicated ediscovery tool. If you are restoring the data from a few devices, you should use the dashboard in the same way as if you were restoring the data for the user. However if you need to restore a larger number of devices there is a web service API available that will allow you to submit a restore specifying multiple device ids to restore from, and multiple device ids to perform the restore. For example, you could specify to restore 15 devices, using 2 different restore devices. When you have submitted this request you will see each of the devices to be restored in the Admin restore tab on the company, and there will not be a restoring device shown. This is because the restoring device won t be allocated until it picks up the job. Each of the 2 restoring devices will pick up a restore for one device and will process all of the files for that device. When it is finished with that device it will get the next restore, until all the restores are completed. This API can be called in various ways, so you can integrate submitting a restore into other processes you have. We also have a sample PowerShell script that can submit a job using this API. Contact support if you want this script. How does this work? When you submit a restore job using either the API or the dashboard, that job is added into the list of pending restores in the vault. As each device checks in with the vault to check for changes in status or policy, it will also check for a restore job for that device. If there is a restore job, and the device is currently able to process that restore job, it will change the state of the job to restoring and start working on it. If the restore is for a different device, the first step of working on it is to download the information about the files to be restored. This is similar to the process that a device goes through when reactivating. This step requires decrypting this data, and can currently be done only if the appropriate keys are in the vault, not in a reset server. If you are using a reset server, then restores can only be performed by the device that protected the data because it already has the necessary keys. 8

9 After this information has been downloaded it will start restoring, which is just the same as if the data had been protected from this machine. Blocks are downloaded and then the files reconstructed and placed in the restore location. During this process you will see status in the client as well as in the Activity tab of the device performing the restore. On the detaile of the job on the client it will show that the restore is for another device. Nothing is shown on the device the data came from, either on the dashboard or client. While the restore is progressing, the device continues to regularly check in with the vault. If the restore is cancelled through the dashboard, then when the device checks in it will see that and cancel the restore. If the restore was small, it will probably finish anyway because the device won t see the cancellation until it is already done. Managing restores and troubleshooting Sometimes when you submit a restore you will get an error, for example: If a reset server is used or if a passphrase is used (not common), you can restore only back to the original machine, as a different machine will not be able to access the data If there is a problem with the path that you entered the path must be valid on either Windows (start with x:\ where x is any drive letter) or OS X (starts with /) or a network location (starts with \\) The Admin restores tab on the company shows the high level status of restore jobs, along with a link to the restoring device activity page so that you can get more details such as the amount of data downloaded for the restore. The first aspect to managing the restore is making sure that a device starts the restore. If the device is available to do the restore it should pick it up within a minute or two, so a refresh of the Admin restore tab will change status to Restoring. If this doesn t happen, here are a few reasons why it may not: The device may not be currently online click the Restoring device link and check the time at the top of the activity page to see when it last checked in with the vault The device may already be restoring (either another admin restore or a user restore) check the activity page to see what the device is currently doing. If it is restoring then this restore will wait until the current restore finishes. If the device is currently running a protection job then the restore should interrupt it. The client installed must be v7.0 or later check on the device details tab. If an earlier version is installed then the restore will wait until the correct version is installed (which could be an upgrade or reset/reactivate on different hardware) The device must be in the Activated state check on the device details tab to make sure it isn t reset or suspended for example. If it is, then the restore will wait until the device is activated. If the restore completes with issues, check the activity from the restoring device to see if there is more information. If you can access the restoring machine directly you can check the state of the job in the client and see what the issues were. Otherwise you may need to look at vault logs. A common reason why a job may have issues is that the restore location can t be accessed. For example, you selected a network location and the agent doesn t have permission to that location, it is restoring to drive that doesn t exist, or you are restoring on a Windows machine using an OS X style path or vice versa. 9

10 You may also need to manage the bandwidth taken by restores. Normally this isn t an issue because restores are fairly rare, but if you are using multiple machines to perform a lot of restores such as in an ediscovery scenario you may cause impact to your network or vault. Here are some things to consider: Use a QuickCache to manage the bandwidth if you set up your restore devices to use a QuickCache, you can adjust the allowed download bandwidth for peak and off-peak times. This bandwidth is across all devices using that QuickCache. Use policy to manage the bandwidth on each device the default bandwidth limit for a device downloading from the vault is 2MB/s. If you have multiple devices in the same location without a QuickCache you may want to decrease this. On the other hand, if you have a single restoring device doing big restores and are in a location with sufficient connectivity you may wish to increase this. If you are restoring in the same location as the original backups were done, then if the restoring device can use the same QuickCache as the original device then it will be able to use any data that is currently cached. 10