PSA: Verify your backups

[PliotronX]

Just wanted to tell a story that is still unfolding about an office whose accounting data was set to only back up using windows backup and my coworker who set it up a while ago did not realize that windows backup does not purge old backups so it just fills the backup target up until it can't back up without logging errata so windows backup still shows that it backs up. One has to use a registry change and a scheduled task to prune old backups with windows backup. So the result is that this particular computer acting as the 'server' was hit by Zepto/locky/Thor and the ransom was paid and the decrypter tool fails to restore the accounting data and the latest backup is from June.

No matter your backup solution, heed this story and periodically restore a file from backup to verify functionality because this seems worse than not having backups at all. Especially because my coworker whom thought everything was fine and restored initially what he thought was the previous days backup which complicated decryption or file recovery (writing to the original drive).

Bonus Tip!
Rename the vssadmin.exe to thwart routine deletion of shadow copies. Shadow copies are no replacement of backups but could be the quickest and easiest way to restore files.

 

[Red Squirrel]

Thanks for the reminder, I have not done this myself in a while.

I use rsync so it just keeps the destination in sync with the source, but still worth checking out making sure it's running correctly. All my cron jobs send an email but I often neglect to go through them.

 

[KillerBee]

Surprised you didn't say former coworker

 

[PliotronX]

Thanks for the reminder, I have not done this myself in a while.

I use rsync so it just keeps the destination in sync with the source, but still worth checking out making sure it's running correctly. All my cron jobs send an email but I often neglect to go through them.

Same here! It's so easy for small things to slip through the cracks resulting in devastation.

Surprised you didn't say former coworker

Hah, I stopped wondering about this because I've come to grips with the fact that he is such a brown noser and is the most highly certified tech in the office (he is reimbursed for failing certs until he takes notes on incorrect answers and barely passes, preferential treatment). He has a history of neglecting backups and losing company data yet I don't think the boss has ever even thought about letting him go. I digress, I use his eff ups as a learning project.

 

[mrjminer]

Good tip. Honestly sounds like an easy mistake to make, so I'll have to log this in my brain for future reference. Thanks