SOLUTION GUIDE AND BEST PRACTICES Last Updated December 2012 Solution Overview Combine the best in bare-metal backup with the best in remote backup to offer your customers a complete disaster recovery solution: Use ShadowProtect Server Edition to create volume backups of your servers OS and critical applications, employing ShadowProtect s rapid incremental backups to meet your Recovery Time Objective requirements. Use efolder to efficiently backup and maintain a history of your users data on file servers, as well as to safely store ShadowProtect image files offsite. efolder s flexible versioning policies allow you maximize use of remote storage. For example you could configure it to keep unlimited historical versioning of financial data, while only keeping 2 weeks of versions for photographs. efolder s powerful local backup features complement the ShadowProtect local backup, allowing you to additionally keep an encrypted and versioned repository of all of your data locally for fast restores. Use the efolder Continuity Cloud to virtualize your server backup images in the cloud. Combining both volume-level backup and file-level backup in this way allows for rapid recovery of servers and their critical data, while also providing remote restore, instant online access, flexible retention policies, and unlimited historical versioning for users individual files. Best Practices This guide will walk you step-by-step through the process of combining the efolder and StorageCraft products.
efolder / StorageCraft ShadowProtect Solution Guide and Best Practices Page 2 Process Overview First, provision efolder accounts for computers that will be backing up data remotely, and install ShadowProtect on those computers requiring volume-level backups. Next, configure ShadowProtect to perform volume backups of your OS and critical server applications. Finally, configure efolder to backup other files and your ShadowProtect volume backup images. We have carefully identified proper procedures and guidelines in this document for safe, secure, and optimal backup performance with ShadowProtect 5.0 and 4.x. If you have questions, wish to deviate from the guidelines, or have a different version of ShadowProtect, please contact us first at support@efolder.net. Assess Requirements, Provision Accounts, and Install Software First, assess the backup requirements of your customer. Identify the following: Critical application servers, such as Exchange, SQL, and SharePoint The Recovery Point Objective for these critical applications Where to store volume backup images Data that must be retained for years, because of compliance or company policy Files that users may want to restore individually or access from the web ShadowProtect should be used to backup the volumes of your critical application servers. efolder should be used to backup file-based data and the images generated by ShadowProtect. Install and license ShadowProtect on each application server. Use the efolder partner portal to configure a new efolder account for each computer that will be performing remote backup. Normally you only need one account (that will backup the ShadowProtect data for all of your local bare-metal backups). Download and install your branded efolder Backup Manager onto each computer that will be performing remote backup. Normally all ShadowProtect backups should be configured to store their backup images to subfolders of a single location, and then the efolder backup manager only needs to be configured to backup this one location to capture all of your ShadowProtect volume images. Configure Volume Backups with ShadowProtect Configure ShadowProtect on each server that requires volume backups. Refer to the ShadowProtect documentation for installation and licensing instructions. TIP: We recommend storing your OS and application data on separate volumes. This allows incremental backups of the OS volume to be performed less frequently (as desired) than for volumes storing application data.
efolder / StorageCraft ShadowProtect Solution Guide and Best Practices Page 3 NOTE: For servers hosting active directory the OS volume will contain application data, so make sure you schedule incrementals on the OS volume to meet your Recovery Point Objective for active directory. Once installed, start the ShadowProtect manager and connect to the server you need to configure. Start the backup wizard and click next to see a list of volumes to backup: If you have separate your OS and data volume (as you see above), then you should setup separate backups, one for each volume. In this example, we have chosen the volume containing the Exchange Store. Click Next, and then configure where to store the volume images. You should choose a location that is not on one of the volumes being backed up:
efolder / StorageCraft ShadowProtect Solution Guide and Best Practices Page 4 In this example, the ShadowProtect volume images are stored on a network share. Click Next to schedule the backup for this volume: For best performance, change the VSS incremental backup from Sunday to Saturday and set the start time for the VSS backup to well before 6pm (e.g., noon). You should not schedule incremental backups at night, but rather allow a time window for the remote backup to finish. TIP: For most efficient remote backups of your volume images, we recommend using the Continuous Incrementals schedule and using the ImageManager per our recommendations below. Click Next to set the options for this backup:
efolder / StorageCraft ShadowProtect Solution Guide and Best Practices Page 5 Optionally, use ShadowProtect KeyFileMaker to provide for encrypted volume backups. We especially recommend this if you are backing up to a USB disk or to a network share. We recommend using your efolder pass phrase when creating your key file with KeyFileMaker. Because your pass phrase is protected by efolder s secure pass phrase recovery technology, it is an extra safeguard against data loss due to a forgotten ShadowProtect encryption password. NOTE: We do not recommend splitting the image file, because this makes it more difficult to determine consistent restore points. For example, if you have an image split into two pieces, and efolder backs up changes to the first part successfully, but is then interrupted while backing up the second part (e.g., because the server is rebooted), the remote server will have an updated copy of the first part of the image, but the second part of the image will still be outdated. Splitting a very large image into pieces may be worth the effort for very slow connections (< 500 Kbit/sec), but if you do this, be extra careful which versions you select when restoring data to be sure that the pieces all represent the same snapshot. We recommend leaving the advanced options to their default settings. If you are backing up a volume that is mostly full, you can further improve efficiencies of remote backup deltas by checking the Include Free Space on the Backup tab of the Advanced options. You may also want to turn on write caching in the Advanced options to improve performance. Click Next to see a Summary of your backup settings. You can choose to either perform the initial volume backup now or wait for the scheduled backup to occur. Install and Configure ShadowProtect ImageManager ShadowProtect uses forward deltas that require periodic management. ShadowProtect ImageManager is a utility that consolidates hourly incrementals into daily incrementals, daily incrementals into weekly incrementals, weekly incrementals into monthly incrementals, and monthly incrementals into rolling incrementals. You only need to install ImageManager on the computer that is physically storing the volume images. Typically this is the same computer that also is using efolder to remotely backup the volume images. The strategy for efficient backups is to have efolder backup only the daily, monthly, and rolling incrementals. The hourly and weekly incrementals are redundant and do not need to be backed up remotely. Once installed, start the ImageManager, connect to localhost. For ImageManager 3.5, click the New button to add a new policy. For ImageManager 4.0 (or later), click the Start Managing Folder button, and then click Consolidation Settings (Retention Settings in v6.0 or later). Adhere to the following guidelines when configuring the ImageManager settings: Choose a processing time that is about 10 minutes after your incremental backups end for the day. For example, if continuous incrementals end at 6:00pm, set the time to 6:10pm. If you are using the new 4.0 version of ImageManager, the processing time can
efolder / StorageCraft ShadowProtect Solution Guide and Best Practices Page 6 be set by clicking the Agent Settings button (gear icon) on the left hand side of the user interface. Version 3.5 only: Set the minutes between collapse operations to 15 so that incrementals are collapsed as fast as possible. Busy servers may want to use 30 or 60 minutes instead. Set the number of days to keep incremental files and weekly files to 0 or higher. efolder will only be configured to backup daily, monthly, and rolling incrementals, so using a higher number will enhance your local backup retention policy, but not affect remote backup. Set the number of days to keep daily files to at least 36. Increasing this beyond 36 will cause your remote backups to upload more data than necessary, but will not otherwise cause problems. o VERY IMPORTANT: You must keep at least 35 days of daily incrementals in order for the remote backup to properly work. Version 6.0+ only: You can choose to only retain the last N months of monthly deltas by checking the Cleanup consolidated monthly image files and specifying the number of months you want to retain. This option will reduce disk space utilization both on-site and in the cloud. Version 3.5 only: Make sure to uncheck the When removing intra-daily files, option. Version 3.5 only: Make sure to check the Keep redundant collapse files option. Version 4.0+ only: Uncheck Move consolidated image files to a subdirectory. For ImageManager 3.5, your configured policy should look similar to the following:
efolder / StorageCraft ShadowProtect Solution Guide and Best Practices Page 7 For ImageManager 4.0 or 4.1, your consolidation settings for the folder should look similar to: For ImageManager 6.0 or later, your retention settings should look similar to: You should specify the desired retention policy for the number of months keep monthly image files. This will allow you to retain less historical data, ensuring that the backup chain does not grow indefinitely in size. Configure Remote Backups with efolder Setting up remote backups on a computer consists of (a) using the efolder partner web portal to provision a new account, (b) installing the efolder software, (c) configuring credentials, encryption pass phrase, folders to backup, data retention policies, and notification options. Settings profiles can be exported/imported to and from files, to easily copy configuration settings from one server to another.
efolder / StorageCraft ShadowProtect Solution Guide and Best Practices Page 8 This guide focuses on those aspects of configuration unique to backing up volume images generated by ShadowProtect. For a detailed reference for all steps of configuration, please refer to the efolder product documentation. To remotely backup ShadowProtect volume images, install efolder on the computer storing the ShadowProtect image files (*.spf, *.spi, etc.) or a computer with access to the NAS device storing the image files. Use the My Account page to configure the account credentials and setup a new pass phrase (alternatively, import an existing settings profile and change the username to match the one assigned to this machine). Next, go to the Folders page, click Visualize!, and click the checkbox next to the folder that contains the ShadowProtect image files to add the folder to the backup, and then uncheck the Incrementals directory (it should turn red): Click Save. Now right click the folder that contains the ShadowProtect volume images and choose Properties. Configure your versioning settings (Options page, Versioning tab) to match your data retention policy. Set the Number of Days to Keep Historical Versions to 14. NOTE: Due to ShadowProtect s daily and monthly incremental files consolidation strategy, the ImageManager must be configured to retain at least 31 days of daily incrementals. The number of Days to Keep Historical Versions indicates how many extra days to keep the consolidated images for. You should always use 5 or more days when setting the Number of Days to Keep Historical Versions.
efolder / StorageCraft ShadowProtect Solution Guide and Best Practices Page 9 Make sure that Destroy Excluded Files is set to No. We recommend changing the Disable Open File Backup option to Yes if efolder is installed on a server that is also performing ShadowProtect continuous incremental backups. This will prevent the StorageCraft incremental backups from interfering with the efolder backups. Even with open file backup disabled, efolder checks to make sure files are not modified during backup, preserving data integrity. Click Save to save all changes. Next, we need to configure the backup policy to exclude hourly and weekly incremental files. The efolder Backup manager version 3.8.2 (and later) includes a policy, Backup ShadowProtect Images, that does this for you. To use it, follow these steps: In the efolder backup manager, go to the Folders page. Right click the folder with the ShadowProtect data and choose Set Policy, and select Backup ShadowProtect Images: To make sure you are using the correct policy, right click on the folder again and choose Edit Policy.
efolder / StorageCraft ShadowProtect Solution Guide and Best Practices Page 10 Make sure the selected policy is now Backup ShadowProtect Images. It should look like: Save all changes on all dialogs, to get back to the main online backup manager window. The next step is to set the appropriate time to begin remote backups. Use the Schedule page to set the remote backup schedule for once per day, starting one hour past you re your continuous incremental backups end. For example, if ShadowProtect continuous incremental backups end at 6:00pm, schedule the remote backup to start at 7:00pm. If you are using efolder to also perform local disk or local network backups, you may schedule them as frequently as you like they will not interfere with ShadowProtect. TIP: If efolder and ShadowProtect are installed on the same server, and ShadowProtect is configured to perform VSS backups (as we recommend), then go to the Backup tab of the Options page in efolder, and change the Volume Shadow Backup Type from Full to Copy. This ensures that efolder does not interfere with the ShadowProtect backups. Next, check if ShadowProtect integration is enabled. To do this, go to the Folders page and right click on the folder containing ShadowProtect files. You should see several properties related to ShadowProtect (you may have to scroll down). If you do not, close the dialog and go to the Backup tab of the Options page and change the Path to sbrun.exe option. Once you have done this, make sure that ShadowProtect integration is enabled using the folder properties page. With ShadowProtect integration enabled, efolder will automatically verify the integrity of the ShadowProtect files as they are backed up, will automatically verify that the chain of incrementals has not been broken, will automatically verify that ImageManager is working correctly, and will verify that regular ShadowProtect backups are happening every day. Remote backups of your ShadowProtect volume images are now properly configured. Configure the remaining efolder options as you normally do. Optionally configure efolder local backups. TIP: Performing the initial remote backup may take several days or longer depending on the size of the volume images and the upload speed of the Internet connection. Use our speed test at http://efolder.net/speedtest/ to estimate upload speed. For large data sets (more than 50GB) you may want to use our Preload to USB disk feature, which allows the initial remote
efolder / StorageCraft ShadowProtect Solution Guide and Best Practices Page 11 backup to be preloaded to a USB disk, which is then shipped to our data center. For further details, please visit our knowledge base or contact us. CAUTION: Never destroy any of the full backup or incremental files (*.spf, *.spi) in the backup repository. ShadowProtect continuous backups require an unbroken chain of deltas in order to restore a current volume image properly. Older daily delta files will be automatically purged from the backup when it is safe to do so if you have set your versioning policy as described above. Restoring, Migrating, or Virtualizing Servers To restore servers (or migrate servers to new hardware) when you still have access to the local ShadowProtect volume images, follow the normal ShadowProtect bare-metal restore procedure using the bootable restore environment. If you have been backing up your volume images with efolder local or remote backups, you can use efolder local or remote restore to restore your.spf and.spi files if they ever become damaged. You can also use StorageCraft VirtualBoot to quickly virtualize any of your backup recovery points that are local. You can use the efolder Continuity Cloud to virtualize your ShadowProtect backups in our cloud. See the efolder Continuity Cloud ShadowProtect Howto Guide for detailed instructions. Files that are remotely backed up to efolder s data center are protected by efolder s extremely rigorous data integrity procedures. All remotely backed up data has an embedded cryptographic fingerprint that is verified upon restore, certifying the restored file is exactly identical to the backed up file. Additionally, we use block-level checksums to automatically guard against and safely repair any silent data corruption that occurs with any electronic storage device. efolder also verifies the MD5 checksum that was generated by ShadowProtect to ensure that the file that was backed up was not damaged. Your files are safe with us. If your local chain of ShadowProtect incrementals becomes damaged, you can be assured that efolder will have a good, undamaged copy ready for restore. You should make sure that you are utilizing the notification and alerting features in the efolder partner web portal so that you will be alerted if any local ShadowProtect or cloud backups fail and need attention. Restoring Individual Files The efolder restore wizard allows you to easily restore files and folders for data backed up directly with the efolder Backup Manager simply by logging in, checking off the data you want to restore, choosing the point-in-time version, and choosing where you want to restore the data. Customers can also login on the web to access their files anytime, anywhere at http://efolder.net/ or your fully branded customer web portal. Recovering from a Disaster
efolder / StorageCraft ShadowProtect Solution Guide and Best Practices Page 12 To recover from complete data loss at the local site: 1. Provision appropriate bare-metal or virtual machines for the server(s) you need to restore. Make sure there is enough disk space to fully contain the restored volumes. 2. Use efolder Web Access to download the.spf and all.spi files for the relevant OS and application volume image(s) to a portable USB disk or network share accessible from the ShadowProtect bootable restore environment. TIP: Be sure to uncheck the Include the deleted date and time in the restored filename option, so that the restored files are named properly. 3. Use the ShadowProtect bootable restore environment to deploy the volume images to the new bare-metal server or virtual machine. Or if you have ShadowProtect 4 or 5 and used ShadowProtect to backup all volumes of your server, you can also use the VirtualBoot feature to instantly boot a virtual machine from the most current *.spi file. 4. With the server and critical applications fully restored, login and immediately change the efolder schedule to manual (if efolder is configured on the machine). 5. Start the efolder file manager to restore any remaining file-based data as needed. 6. With all data fully restored, set the efolder schedule back to Weekly. Additional Assistance We will assist you any way that we can. Please submit questions to support@efolder.net, call us at 800-352-0248, or browse our knowledge base at https://secure.efoldering.com/support/kb/