Helpful first: Data protection and resilience: why encryption is not a backup plan · Quantitative risk and BIA math: SLE, ALE, RTO, and RPO
Key points
- Select Cold, Warm, Hot, or Mirrored recovery sites based on the Business Impact Analysis Recovery Time Objective (RTO).
- Compare backup speed and restore tape/set count across Full, Differential, and Incremental backup schedules.
- Calculate disk fault tolerance and usable capacity for RAID 0, RAID 1, RAID 5, RAID 6, and RAID 10 arrays, and sequence the five DR test levels from Read-through to Full Interruption.
Recovery site tiers and RPO/RTO alignment
Disaster recovery (DR) facilities are selected to satisfy the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) established during the Business Impact Analysis (BIA). Because facility readiness costs scale nonlinearly, organizations tier their systems rather than putting every workload in a mirrored facility.
A Cold Site provides only basic building shell, power, HVAC, and physical security; no servers or communications links are pre-provisioned, yielding recovery times measured in weeks. A Warm Site includes pre-installed racks, network connectivity, and base compute hardware, but requires loading recent backups before operations resume (hours to days). A Hot Site maintains fully configured hardware and near-real-time replicated data, enabling cutover within minutes to a few hours. A Mirrored Site operates as a redundant, fully synchronized active-active environment across independent failure zones, achieving near-zero RTO and RPO.
| Facility Tier | Pre-Provisioned State | Typical RTO | Relative Cost |
|---|---|---|---|
| Cold Site | Facility shell, power, and cooling only; no compute or data | 1 to 4 weeks | Lowest |
| Warm Site | Network circuits and compute racks installed; backups must be restored | 12 to 72 hours | Moderate |
| Hot Site | Full server stack with asynchronous or near-real-time data replication | Minutes to 4 hours | High |
| Mirrored Site | Redundant active-active infrastructure with synchronous replication | Near zero (seconds) | Highest |
Full, Differential, and Incremental backup mechanics
Operating systems track modified files using an archive attribute (archive bit). When a file is created or modified, the OS sets the archive bit to 1. Backup strategies differ in which files they copy and whether they reset (clear) that archive bit to 0.
A Full backup copies all selected data regardless of the archive bit and clears the archive bit on every file. An Incremental backup copies only files modified since the most recent Full or Incremental backup and clears the archive bit; this makes daily backups very fast and small, but restoration requires the last Full backup plus every subsequent Incremental set in chronological order. A Differential backup copies all files modified since the last Full backup and does not clear the archive bit; each daily Differential grows larger over the week, but restoration requires at most two sets: the last Full backup and the single latest Differential backup.
RAID levels and Disaster Recovery test maturities
Redundant Array of Independent Disks (RAID) combines multiple physical drives into a logical unit to improve performance, fault tolerance, or both. RAID 0 stripes blocks across drives for speed but offers zero redundancy; losing one drive destroys the array. RAID 1 mirrors data across drive pairs (50 percent usable capacity). RAID 5 stripes data with single distributed parity across at least 3 drives (tolerating 1 drive failure, usable capacity N-1). RAID 6 uses dual distributed parity across at least 4 drives (tolerating 2 concurrent drive failures, usable capacity N-2). RAID 10 (1+0) stripes across mirrored pairs (minimum 4 drives, fast rebuilds without parity calculation overhead).
To prove that DR plans work under pressure, organizations progress through five test levels: (1) Checklist / Read-through (distributing plans to leads for review), (2) Structured Walk-through / Tabletop (team members verbally step through a scenario in a conference room), (3) Simulation (practicing response and call trees without cutting over production traffic), (4) Parallel Test (processing live transactions on the recovery site alongside the primary site without disconnecting primary production), and (5) Full Interruption Test (shutting down the primary site to prove the recovery site can bear full production load alone).
CHECK YOUR JUDGMENT
A critical database takes a Full backup every Sunday night. On Monday, Tuesday, Wednesday, and Thursday nights, the backup job copies all blocks modified since Sunday and leaves the archive bit unchanged. On Friday morning, the storage array fails completely. How many backup sets must the administrator load to restore the database through Thursday night?
NEXT FIELD LESSON