Site icon Eminence Papers

System Backup and Restore Tools – iDrive

Perkins

System Backup and Restore Tools – Drive

iDrive is an application that offers efficient cloud storage that allows users to back up their devices. Users can utilize the downloadable application tool, which simplifies the process of navigation and uploading files. This powerful application does not only back up files from an unlimited number of a user’s personal device, but also the photos from social media accounts such as Instagram and Facebook. Additionally, the files are synchronized across all the devices of the user. This ensures that in case of any modification, the files are updated on all the devices (“Business Software Index,” 2018). The applications come with a variety of plans for commercial or personal use.

Part (a): Creating a “Known-Good” (Clean) Disk Image for a Windows 8.1 Workstation

It is inevitable that the disk will wear out someday. To protect the system data and applications from disk failure, it is crucial to create an image of the hard disk. When using iDrive, this process is simple, and the retrieval process is less time-consuming (iDrive, 2018). This is due to the fact that one need not install the operating system separately and then restore the data. The initial system can be restored in less time.

Creating a System Image

Using the disk image utility of iDrive, one can back up the whole hard drive with contents that are identical to the original storage device. This includes not only the data but also information about the structure. Local backup to an external drive or cloud backup can be done using this application. The disk image backup can be done for all the major versions of Windows Operating Systems and Servers. Due to the cross-platform compatibility, the image can be accessed from Linux or Mac. iDrive has an incremental backup so that the changing data blocks are backed up. The process of creating a disk image is as follows (iDrive, 2018):

  1. Launch the iDrive desktop application.
  2. The user should log into the application using the password and username. In the case that a private encryption key was set up by the user, it should be provided.
  3. Once logged in, the user should click the Disk Image Backup button to open the window for Disk Image Backup.
  4. Once the window opens, the drive which should be backed up is selected.
  5. From the drop-down ‘Select the location for creating Disk Image, ’ the drive for which an image should be created is selected.
  6. The next step is to select the option ‘Local Backup’ or ‘Online Backup.’
  7. Afterward, the schedule can be created by clicking the ‘Schedule Now’ button.
  8. The user can then create a schedule for performing regular disk image backups. The next step is to click the ‘Save Changes’ button.

Generating a hash code for verifying the validity and integrity of the system image

Since iDrive does not have hash code verification for file validation, as a result, a utility tool called HashGenerator can be used for windows. This application has an installer and a portable version. This tool can calculate the hash file of data by using the Browse button or by dragging and dropping (iDrive, 2018). Hash types available are up to fourteen, such as MD5, SHA family, Whirlpool, and CRC32, among others. After creating an image backup using iDrive, the file can be verified before uploading it to the servers. During the recovery, the file should be checked against the code that was generated. If they match, then the file is valid and has integrity.

Best Practices for Labeling and Storing digital media with system image files

When using iDrive, a user can easily access the backed-up hard drive image from a different computer. The entire Operating system and its contents can be obtained. For a user to be able to access the data in the disk image form a different computer, they need to mount the image backup on the new device and accordingly restore the required files. The following steps should be followed when carrying out this:

  1. Installing OSFmount Build after downloading it.
  2. After installation, the user can browse the image file, which should be mounted on the OSFMount wizard.
  1. From the mounted drive, the required files can be saved.

Guidance Document

iDrive has many capabilities, including multiple device backup. The software can back up an unlimited number of the devices of a user. The iDrive Express can quickly backup and retrieve data in less than one week through a shipment of physical storage. Snapshots feature in the application enables historical data view to facilitate recovery based on a point in time; this can help minimize the effects of ransomware. There is a web console that helps in the management of the backups, application settings, and data restore. The application uses 256-bit AES encryption during file transfer; it uses a private key that is user-defined and not stored on the servers (iDrive, 2018). iDrive has a real-time data backup system that automatically recognizes the parts of the files that have changed and performs a backup in real-time. More information regarding iDrive can be found on their website https://www.idrive.com.

Part (b): Using a “Known-Good” (Clean) Disk Image to Restore the System Hard Drive for a Windows 8.1 Workstation

Verifying the validity of a backed-up image

As stated earlier HashGenerator can be used in Windows to test if the backed image file is valid. This application has an installer and a portable version. This tool can calculate the hash file of data by using the Browse button or through drag and drop. Hash types available are up to fourteen, such as MD5, SHA family, Whirlpool, and CRC32, among others (Raymond, 2016). After creating an image backup using iDrive, the file can be verified before uploading it to the servers. During the recovery, the file should be checked against the code that was generated. If they match, then the file is valid and has integrity.

  1. Recovery of Windows 8.1 using the system image
  2. Before being able to restore the system image using Drive, some prerequisites are required; these include:
  3. A bootable DVD or USB medium for booting the computer.
  4. iDrive disk image utility should be downloaded and copied to the USB drive.
  5. The Disk Image backup for the drive that was backed up is also needed.
  6. A new hard drive for which the restore will be carried out.

Steps for recovering the operating system

  1. Connect the drive and start the device in the WindowsRE environment that is provided by the USB drive.
  2. The user should then select the layout of the keyboard and click Troubleshoot >Advanced Options > Command Prompt.
  3. The command window will come up.
  4. From the command line interface, the backup.ini file should be located in IdriveDiskImage\<Name>\C\Backup.ini folder. This enables the acquisition of the size of MBR/GPT/OS for the partition creation.
  5. The image drive for operating system should be located, an example of the name would be, DiskImage[D].img. After this, the partitions should be created using the diskpart command.
  6. Next, the GPT or MBR drive image should be restored using the specific Windows commands.
  7. The drive image of the Operating System should be restored, and the booting commands should be executed to enable the drive to boot.

Performing a  recovery from the same hard drive

  1. Connect the drive and start the device in the WindowsRE environment that is provided by the USB drive.
  2. The user should then select the layout of the keyboard and click troubleshoot >Advance Options > Command Prompt.
  3. The command window will come up.
  4. From the command line interface, the backup.ini file should be located in IdriveDiskImage\<Name>\C\Backup.ini folder. This enables the acquisition of the size of MBR/GPT/OS for the creation of the partition.
  5. The image drive for the operating system should be located; an example of the name would be DiskImage[D].img. After this, the partitions should be created using the diskpart command.

Restoring the system after an attack

To restore the system to a previous point in time after an attack the snapshot feature should be used. Snapshots are capable of giving a historical view of the data in the iDrive account. In case a system is compromised, all that is needed is the selection of a point in time before the incident. The data from that time can be restored.  To carry out the system restore to a previous time, the following steps should be followed (iDrive, 2018):

  1. After opening the iDrive desktop application, the user should select the Snapshots tab.
  2. The next step is to choose the date and time and the dates submitted. After this, the data that was backed up before or on that date appears.
  3. The required files and folders are then chosen and can be restored. Additionally, the system image from a specific point in time can also be retrieved and restored.
  4. To recover the drive, the following command should be executed

$IDriveDiskImage.exe if=<OS DriveImage path> iflag=coe of=<partition drive> oflag=coe bs=4096 count=<Image Size in bytes>

Guidance document

Some of the important steps of recovering the hard drive from the image include having a copy of Disk Imaging Utility software to create a bootable USB/DVD drive. iDrive has many capabilities, including multiple device backup. The software can back up an unlimited number of the devices of a user. The iDrive Express can quickly backup and retrieve data in less than one week through a shipment of physical storage. The snapshots feature in the application enables a historical data view to enable recovery based on a point in time; this can help minimize the effects of ransomware. There is a web console that helps manage backups, application settings, and data restoration. The application uses 256-bit AES encryption during file transfer; it uses a private key that is user-defined, not stored on the servers. iDrive has a real-time data backup system that automatically recognizes the parts of the files that have changed and performs a backup in real-time. More information regarding iDrive can be found on their website https://www.idrive.com.

References

iDrive. (2018). Backup ALL your PCs, Macs, Servers, and Mobile Devices to ONE account! Retrieved from https://www.idrive.com

Business Software Index. (2018). Idrive Cloud Storage. Retrieved from https://www.pcmag.com/business/directory/cloud-storage/696-idrive-cloud-storage

Raymond. (2016). 10 Tools to Verify File Integrity Using MD5 and SHA1 Hashes. Retrieved from https://www.raymond.cc/blog/7-tools-verify-file-integrity-using-md5-sha1-hashes/

 

 

ORDER A PLAGIARISM-FREE PAPER HERE

We’ll write everything from scratch

Question 

System Backup and Restore Tools – Drive

Purpose: Assess and Document Tools to Backup and Restore the System Hard Drive for a Windows 8.1 Workstation.

  1. Assess and document the use of a system backup tool or disk imaging utility to create a “known-good” copy of the system hard drive for a Windows 8.1 Workstation.
  2. Assess and document the use of “known-good” copies of system hard drives to restore system availability after an incident.

Overview:

For this activity, we will focus on assessing and documenting tools used in the preparation, containment, eradication, and recovery phases of the Incident Response Process (as defined in NIST SP 800-61r2). These tools will support incident responders by providing “access to images of clean OS and application installations for restoration and recovery purposes” (Cichonski, Millar, Grance, & Scarfone, 2012, p. 23).

Situation Report:

Recent contracts with the Departments of Defense and Homeland Security have imposed additional security requirements upon the company and its SCADA lab operations. The company is now required to comply with NIST Special Publication 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations. The company must also comply with provisions of the Defense Federal Acquisition Regulations (DFARS), including section 252-204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. These requirements are designed to ensure that sensitive technical information provided by the federal government and stored on computer systems in the Sifers-Grayson SCADA lab is protected from unauthorized disclosure. This information includes software designs and source code for Industrial Control Systems for which Sifers-Grayson is providing software support and maintenance. The contract requirements also mandate that Sifers-Grayson report cyber incidents to the federal government in a timely manner.

The engineering and design workstations in the Sifers-Grayson SCADA Lab were upgraded from Windows XP to Windows 8.1 professional three years ago after the lab was hit with a ransomware attack that exploited several Windows XP vulnerabilities. A second successful ransomware attack occurred three months ago. The company paid the ransom in both cases because the lab did not have file backups that it could use to recover the damaged files (in the first case) and did not have system backups that it could use to rebuild the system hard drives (in the second case).

The SCADA Lab is locked into using Windows 8.1. The planned transition to Windows 10 is on indefinite hold due to technical problems encountered during previous attempts to modify required software applications to work under the new version of the operating system. This means that the lab’s incident response and recovery capability must support the Windows 8.1 operating system and related engineering software applications. However, the customer’s technical representatives have strongly suggested that Sifers-Grayson personnel use backup utilities that are not specific to the Windows 8.1 operating system. 

Resources for these exercises: https://www.howtogeek.com/242428/whats-the-best-way-to-back-up-my-computer/

https://www.pcmag.com/article2/0,2817,2278661,00.asp https://www.pcmag.com/article2/0,2817,2288745,00.asp (my tool choice is IDrive)

http://www.enterprisefeatures.com/top-25-enterprise-online-backup-solutions-for-business-cloud-data-protection/

https://www.idrive.com/ (IDrive website)

Reference

Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer security incident handling guide (NIST SP 800-62 rev. 2). http://dx.doi.org/10.6028/NIST.SP.800-61r2

Your Task

Prepare draft incident response guidance to be included in the Sifers-Grayson Incident Responder’s Handbook. Your draft guidance will explain the use of a commercially available system hard drive backup tool. Your guidance will explain how to use your selected third-party tool to create either a system backup or a system image (bit for bit copy) of the system hard drive for a Windows 8.1 workstation. Suggested tools include: Acronis, FTK Imager, and Paladin.

You will create two separate procedures. The first will explain how to perform a backup. The second will explain how to use the known-good backup to restore the system hard drive (also, how to restore to a new hard drive). Both procedures must address the use of cryptographic hash codes (e.g. MD5 or SHA-256) to verify the integrity of the backup files and/or system image files.

Instructions

Part (a): Creating a “Known-Good” (Clean) Disk Image for a Windows 8.1 Workstation
  1. Using the Internet, research commercially available system backup tool or application. (Do not use any features or utilities that are part of the Windows operating system.) Then, identify appropriate sources of information and instructions for your selected tool. Using those sources, research the procedures required to
    1. Create a “known good” copy (system backup or complete system image) of the hard drive containing the Windows 8.1 system and installed applications for a workstation in the SCADA lab.
    2. Generate a hash code for use in verifying the validity and integrity of the backup file or system image file. (If your backup utility does not provide this, you will need to find a separate tool that will generate an MD-5 or SHA-256 hash value for the image file or backup file. See https://www.howtogeek.com/67241/htg-explains-what-are-md5-sha-1-hashes-and-how-do-i-check-them/ for an explanation of file integrity checking using hash codes.)
    3. You should also research and document best practices for labeling and storing the digital media containing the backup files and/or system image files. The storage location should provide secure storage yet be readily available to incident responders in the event of an incident. The label or storage log should include the hash value for each backup file and system image file.
  2. Identify how the backup tool could be used during the preparation phase of the incident response and recovery process. Typical uses include:
    1. Create a “known good” backup that contains a complete, verified and approved system configuration that includes the operating system and all required application software.
    2. Create a copy of the original operating system installation (before software applications are installed).
  3. Write a guidance document that identifies the tool, explains the capabilities it provides, and then lists and briefly describes the recommended uses identified under item #2. Add a list of resources that can be consulted for additional information. Next, summarize the procedures required to perform the tasks listed under item #1 (do not provide step-by-step instructions). Close your guidance document with a Notes / Warnings / Restrictions section that answers the question, “Is there anything else the incident responder needs to be aware of when using this tool?”

Part (b): Using a “Known-Good” (Clean) Disk Image to Restore the System Hard Drive for a Windows 8.1 Workstation

  1. Use the same tool and tool research as performed for part (a) of this lab. If necessary, identify additional sources of information and instructions for using your selected tool(s) to perform the following tasks:
    1. Verify the validity of the backup image or file (using the hash code).
    2. Use the “known good” copy (system backup or system image) to rebuild a workstation hard drive so that it contains the Windows 8.1 operation system and installed applications.
  2. Identify how the tool could be used during the containment, eradication & recovery phase of the incident response and recovery process. Typical uses include:
    1. Restore workstation hard drives to a “known good” configuration.
    2. Build a new system disk using a replacement or newly purchased hard drive.
    3. Restore the system to full operating status after an attack or suspected attack.
  3. Write a guidance document that identifies the tool, explains the capabilities it provides, and then lists and briefly describes the recommended uses identified under item #2. Add a list of resources that can be consulted for additional information. Next, summarize the procedures required to perform the tasks listed under item #1 (do not provide step-by-step instructions). Close your guidance document with a Notes / Warnings / Restrictions section that answers the question “Is there anything else the incident responder needs to be aware of when using this tool?”
Exit mobile version