Faced with the problems of ransomware, disasters and even malicious attacks, it is essential to be able to recover data quickly from the latest backup as well as from much older versions. The time between an incident and its discovery can be several days ; in the case of a malicious act or a handling error it can be several months.

The full backup allows a quick restoration of the entire machine, however the daily differential is not negligible. This is due to applications that are not related to the user’s activity but that generate significant changes : system updates, antivirus databases, internal Windows databases, etc.

Despite backup capacities of several terabytes, it is difficult to keep a history of complete backups for more than a few weeks.

So what are our recommendations in this area ?

You need to create at least two backup sets per machine. In the context of a virtual machine, this involves installing an agent in the hypervisor and in the virtual machine.
A full backup (like any object backup) should use unlimited retention because a hard disk, a database or a virtual machine should never disappear from the backup.
The file backup must correspond to the customer’s activity. Thanks to your expertise and knowledge of your customers, you can include only the working directories : business applications, email, office files, shared documents, etc. For this backup, use the presets “Exclude Temporary Folders and Caches” as well as “Exclude Audio Files” and “Exclude Video Files”.

The two backup sets should be run daily ; if the machine is very large, the full backup can only be run at weekends. By managing full and file backups separately, you protect the machine from a disaster or ransomware attack, and you can directly restore lost, deleted or corrupted files in the event of malicious intent or human error.

To summarise :

1- A complete backup set :
– Scheduling : daily (or weekly)
– Scope : Virtual Machine or Full Disk Image
– Track record : 15 days
– Retention : unlimited

2- A set of backup files :
– Scheduling : daily (or several times a day)
– Scope : Work directories
– Track record : 90 days
– Track record : 180 days